chimera | 62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673

Resubmissions

13-07-2024 20:10

240713-yxnyysxfqf 8

13-07-2024 19:57

240713-ypcwqavemq 10

Analysis

max time kernel
690s
max time network
687s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13-07-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FanControl_193_net_8_0_Installer.exe
Size

14.3MB
MD5

287079832c0d4a7966a0d35ee03a9689
SHA1

d69b33d39b8d0d67f4bb5b60f541fe0ea3229568
SHA256

62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673
SHA512

0cd46c9e43b97ba22bc0ee3666ba408c5cc677511c3e8f2892e4b8ca582886b11a8707679a23fc1e0f39cfdf4f0ecc00ce002181f47ef2ace131e235170ff7e9
SSDEEP

196608:2tH8S4B4hAtkl1czIhgsK+7Gc4uMMywHiBrfkdt4RAiq7Vr5geDQaFGA9iR0vPy9:SHT4BAOIh1K+qc6XF9mDQa8A9ievPNo

Score

10^/10

chimera aspackv2 bootkit discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Chimera 64 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

Processes:

HawkEye.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

Processes:

resource	yara_rule
behavioral1/memory/1220-1409-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Renames multiple (3283) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b	aspack_v212_v242

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 19 IoCs

Processes:

FanControl_193_net_8_0_Installer.tmpFanControl.exeUpdater.exetemp_fancontrol_installer.exetemp_fancontrol_installer.tmpFanControl.exeAnap.a.exeWinNuke.98.exeMabezat.exeAgentTesla.exeAgentTesla.exeHawkEye.exeAdwereCleaner.exe6AdwCleaner.exeChilledWindows.exeCookieClickerHack.exeAvoid.exeHydra.exeMelting (1).exe

pid	process
4312	FanControl_193_net_8_0_Installer.tmp
2104	FanControl.exe
4100	Updater.exe
2544	temp_fancontrol_installer.exe
3792	temp_fancontrol_installer.tmp
1536	FanControl.exe
3900	Anap.a.exe
2144	WinNuke.98.exe
1452	Mabezat.exe
4396	AgentTesla.exe
3192	AgentTesla.exe
1220	HawkEye.exe
2064	AdwereCleaner.exe
2384	6AdwCleaner.exe
3592	ChilledWindows.exe
1604	CookieClickerHack.exe
3936	Avoid.exe
1452	Hydra.exe
552	Melting (1).exe

Loads dropped DLL 5 IoCs

Processes:

FanControl_193_net_8_0_Installer.tmptemp_fancontrol_installer.tmpFanControl.exe

pid	process
4312	FanControl_193_net_8_0_Installer.tmp
4312	FanControl_193_net_8_0_Installer.tmp
3792	temp_fancontrol_installer.tmp
3792	temp_fancontrol_installer.tmp
1536	FanControl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6AdwCleaner.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 26 IoCs

Processes:

HawkEye.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	HawkEye.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	HawkEye.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	HawkEye.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ChilledWindows.exe

description	ioc	process
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
64	raw.githubusercontent.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
5	raw.githubusercontent.com
7	raw.githubusercontent.com
11	raw.githubusercontent.com
35	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

76 bot.whatismyipaddress.com
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

FanControl.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 FanControl.exe
File opened for modification \??\PhysicalDrive0 FanControl.exe

flow	ioc
76	bot.whatismyipaddress.com

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	FanControl.exe
File opened for modification	\??\PhysicalDrive0	FanControl.exe

Drops file in Program Files directory 64 IoCs

Processes:

HawkEye.exetemp_fancontrol_installer.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PaintLargeTile.scale-125.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reject_18.svg	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintStoreLogo.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-32.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-200_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCardActions.base.js	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\FanControl\it\is-VQV0V.tmp	temp_fancontrol_installer.tmp
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-80_altform-lightunplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PeopleAppList.scale-100.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-256_altform-unplated.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-amd\isVirtualElement.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-36_altform-unplated.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-125.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-80_altform-unplated_contrast-white.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-16_altform-unplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-125.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-30.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-36.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-100.png	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Separator.js	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-96_altform-unplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-125.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16_altform-unplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Breadcrumb\Breadcrumb.styles.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-20_altform-unplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-150.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-150.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-lightunplated_contrast-black.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Announced.js	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-32.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-64_altform-unplated.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCardActivity.types.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Background_Dark.jpg	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PaintStoreLogo.scale-100.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-96_altform-lightunplated.png	HawkEye.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSplashScreen.scale-200.png	HawkEye.exe
File created	C:\Program Files (x86)\FanControl\zh-CN\is-8IBFK.tmp	temp_fancontrol_installer.tmp
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-200.png	HawkEye.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-200.png	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png	HawkEye.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 845606.crdownload	nsis_installer_1
C:\Users\Admin\Downloads\Unconfirmed 845606.crdownload	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

FanControl.exeFanControl.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Colors	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Control Panel\Colors	FanControl.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1357358163"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31118769"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 41 IoCs

Processes:

FanControl.exeFanControl.exeChilledWindows.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\CustomActivator = "{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe	FanControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\AppId = "{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId	FanControl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\Has7.0.1Fix = "1"	FanControl.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\RunAs = "Interactive User"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\FanControl\\FanControl.exe\" -ToastActivated"	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1210443139-7911939-2760828654-1000\{0E6E2B42-00FA-4848-B1CD-7B888C32C9A6}	ChilledWindows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\DisplayName = "FanControl"	FanControl.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\FanControl\\FanControl.exe\" -ToastActivated"	FanControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\FanControl\\FanControl.exe\" -ToastActivated"	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\CustomActivator = "{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID	FanControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\Has7.0.1Fix = "1"	FanControl.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1210443139-7911939-2760828654-1000\{908675CD-7380-4885-9FFD-F84217FAB1CC}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\FanControl\\FanControl.exe\" -ToastActivated"	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\ToastNotificationManagerCompat\\Apps\\19B9C7F1-8163-CCFC-CDEB-6AA8AD2EE2E1\\Icon.png"	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\IconBackgroundColor = "FFDDDDDD"	FanControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\RunAs = "Interactive User"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe	FanControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\AppId = "{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}"	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\DisplayName = "FanControl"	FanControl.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}\LocalServer32	FanControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{19b9c7f1-8163-ccfc-cdeb-6aa8ad2ee2e1}	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\ToastNotificationManagerCompat\\Apps\\19B9C7F1-8163-CCFC-CDEB-6AA8AD2EE2E1\\Icon.png"	FanControl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\AppUserModelId\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}/FanControl/FanControl.exe\IconBackgroundColor = "FFDDDDDD"	FanControl.exe

NTFS ADS 26 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 845606.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 945967.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 134825.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 860015.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 359849.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 538337.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 186568.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 713157.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 177.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 375199.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 140507.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Melting (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 865515.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 657959.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 11667.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

FanControl_193_net_8_0_Installer.tmpUpdater.exetemp_fancontrol_installer.tmpmsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4312	FanControl_193_net_8_0_Installer.tmp
4312	FanControl_193_net_8_0_Installer.tmp
4100	Updater.exe
3792	temp_fancontrol_installer.tmp
3792	temp_fancontrol_installer.tmp
576	msedge.exe
576	msedge.exe
3056	msedge.exe
3056	msedge.exe
2132	identity_helper.exe
2132	identity_helper.exe
980	msedge.exe
980	msedge.exe
4004	msedge.exe
4004	msedge.exe
3932	msedge.exe
3932	msedge.exe
3392	msedge.exe
3392	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
1232	msedge.exe
1232	msedge.exe
2420	msedge.exe
2420	msedge.exe
4752	msedge.exe
4752	msedge.exe
3788	msedge.exe
3788	msedge.exe
4752	msedge.exe
4752	msedge.exe
1336	msedge.exe
1336	msedge.exe
2392	msedge.exe
2392	msedge.exe
3120	msedge.exe
3120	msedge.exe
4540	msedge.exe
4540	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid process

3056 msedge.exe
Suspicious behavior: LoadsDriver 8 IoCs

Processes:

pid process

680
680
680
680
680
680
680
680

pid	process
680
680
680
680
680
680
680
680

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

Processes:

msedge.exe

pid	process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

FanControl.exeUpdater.exeFanControl.exeHawkEye.exe6AdwCleaner.exeChilledWindows.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	2104	FanControl.exe
Token: SeDebugPrivilege	4100	Updater.exe
Token: SeDebugPrivilege	1536	FanControl.exe
Token: SeDebugPrivilege	1220	HawkEye.exe
Token: SeDebugPrivilege	2384	6AdwCleaner.exe
Token: SeShutdownPrivilege	3592	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3592	ChilledWindows.exe
Token: 33	2452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2452	AUDIODG.EXE
Token: SeShutdownPrivilege	3592	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3592	ChilledWindows.exe
Token: SeShutdownPrivilege	3592	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3592	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

FanControl_193_net_8_0_Installer.tmpFanControl.exetemp_fancontrol_installer.tmpFanControl.exemsedge.exe

pid	process
4312	FanControl_193_net_8_0_Installer.tmp
2104	FanControl.exe
2104	FanControl.exe
2104	FanControl.exe
2104	FanControl.exe
3792	temp_fancontrol_installer.tmp
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

FanControl.exeFanControl.exemsedge.exe

pid	process
2104	FanControl.exe
2104	FanControl.exe
2104	FanControl.exe
2104	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
1536	FanControl.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

msedge.exeAgentTesla.exeAgentTesla.exe6AdwCleaner.exe

pid process

3056 msedge.exe
4396 AgentTesla.exe
3192 AgentTesla.exe
2384 6AdwCleaner.exe
2384 6AdwCleaner.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FanControl_193_net_8_0_Installer.exeFanControl_193_net_8_0_Installer.tmpFanControl.exeUpdater.exetemp_fancontrol_installer.execmd.exemsedge.exe

description	pid	process	target process
PID 3184 wrote to memory of 4312	3184	FanControl_193_net_8_0_Installer.exe	FanControl_193_net_8_0_Installer.tmp
PID 3184 wrote to memory of 4312	3184	FanControl_193_net_8_0_Installer.exe	FanControl_193_net_8_0_Installer.tmp
PID 3184 wrote to memory of 4312	3184	FanControl_193_net_8_0_Installer.exe	FanControl_193_net_8_0_Installer.tmp
PID 4312 wrote to memory of 2104	4312	FanControl_193_net_8_0_Installer.tmp	FanControl.exe
PID 4312 wrote to memory of 2104	4312	FanControl_193_net_8_0_Installer.tmp	FanControl.exe
PID 2104 wrote to memory of 4100	2104	FanControl.exe	Updater.exe
PID 2104 wrote to memory of 4100	2104	FanControl.exe	Updater.exe
PID 4100 wrote to memory of 2544	4100	Updater.exe	temp_fancontrol_installer.exe
PID 4100 wrote to memory of 2544	4100	Updater.exe	temp_fancontrol_installer.exe
PID 4100 wrote to memory of 2544	4100	Updater.exe	temp_fancontrol_installer.exe
PID 2544 wrote to memory of 3792	2544	temp_fancontrol_installer.exe	temp_fancontrol_installer.tmp
PID 2544 wrote to memory of 3792	2544	temp_fancontrol_installer.exe	temp_fancontrol_installer.tmp
PID 2544 wrote to memory of 3792	2544	temp_fancontrol_installer.exe	temp_fancontrol_installer.tmp
PID 4100 wrote to memory of 2332	4100	Updater.exe	cmd.exe
PID 4100 wrote to memory of 2332	4100	Updater.exe	cmd.exe
PID 2332 wrote to memory of 1536	2332	cmd.exe	FanControl.exe
PID 2332 wrote to memory of 1536	2332	cmd.exe	FanControl.exe
PID 3056 wrote to memory of 3724	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 3724	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 2500	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 576	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 576	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 3792	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 3792	3056	msedge.exe	msedge.exe
PID 3056 wrote to memory of 3792	3056	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FanControl_193_net_8_0_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\FanControl_193_net_8_0_Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\is-FNP16.tmp\FanControl_193_net_8_0_Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FNP16.tmp\FanControl_193_net_8_0_Installer.tmp" /SL5="$500D8,14173373,1339392,C:\Users\Admin\AppData\Local\Temp\FanControl_193_net_8_0_Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\FanControl\FanControl.exe
    "C:\Program Files (x86)\FanControl\FanControl.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Program Files (x86)\FanControl\Updater.exe
      "C:\Program Files (x86)\FanControl\Updater.exe" -v 8
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Program Files (x86)\FanControl\temp_fancontrol_installer.exe
        
        "C:\Program Files (x86)\FanControl\temp_fancontrol_installer.exe" /SILENT
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\is-3NI1P.tmp\temp_fancontrol_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3NI1P.tmp\temp_fancontrol_installer.tmp" /SL5="$800D8,13945377,946688,C:\Program Files (x86)\FanControl\temp_fancontrol_installer.exe" /SILENT
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3792
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /C start /B FanControl.exe -w
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
      - C:\Program Files (x86)\FanControl\FanControl.exe
        
        FanControl.exe -w
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Modifies Control Panel
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff240b3cb8,0x7fff240b3cc8,0x7fff240b3cd8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Users\Admin\Downloads\Anap.a.exe
  "C:\Users\Admin\Downloads\Anap.a.exe"
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Users\Admin\Downloads\Mabezat.exe
  "C:\Users\Admin\Downloads\Mabezat.exe"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4396
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Chimera
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
    3⤵
    - Modifies Internet Explorer settings
    PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1908 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7408 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,16043663975543642575,17956295444847503284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Users\Admin\Downloads\Melting (1).exe
  "C:\Users\Admin\Downloads\Melting (1).exe"
  2⤵
  - Executes dropped EXE
  PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004B8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FanControl\Autofac.dll

Filesize
363KB

MD5
97ca112a53b49ccf2b447e6ed7991c38

SHA1
ffb95e5d461826674f0a1c7303b195a8586c12b9

SHA256
e61b49fe42b7b6772fff826b0b23a8a3317219e17771e0405a0ebef262e6fe81

SHA512
a3c7e9fe70247987787b321099b7d2b8da53739c4956ff4d6daf0e1a60794ca42f1cb82c44589a4d27ea74383dfd82ea6e5f0e6c30def87f649e714114b07f22

Download Submit
C:\Program Files (x86)\FanControl\Configurations\userConfig.json

Filesize
1KB

MD5
0dc5b761ddeb48257842f28adaccf92e

SHA1
2da13543698e574fd0652a883281e5723be6f14e

SHA256
ae18df7b01103f9c9d18b066269b2d8469c4dbd7e07b3f68eb0960389d66ec96

SHA512
2c9e5f77702e045b2b0110433612401af4466530236801845ec556b90fe8c5f7cb2f4c2e41223ab63cd6c6e5a619bdc97a534ab46452f3e10466393ac00774ab

Download Submit
C:\Program Files (x86)\FanControl\Emoji.Wpf.dll

Filesize
1.0MB

MD5
7522766f61c808fa9b338aa210dc61ed

SHA1
bf88ab5573e1173e7cddd1d337d62092f6e3fd91

SHA256
cf7e3689516f5fc27f66e93c8ac59083d2e56df55618d5136e21645fec6f1343

SHA512
8f455cf1306bb054ea82903ea0c56d7e201aceb18cd4bace18a56edb777c122ed8328db85dc0a729f17b0d4d03b1d607ec351b3204f84d9c026e59b36cdaf58d

Download Submit
C:\Program Files (x86)\FanControl\FanControl.IPC.dll

Filesize
26KB

MD5
b892ef3eb08299235c2912cddb9b1aee

SHA1
c656c7660ed12f4734b384ae941562b7b5054bdf

SHA256
5b2c514cf2bb46345384befb93937257aa0ebc8510a97b40dd4344585d9146cf

SHA512
33d3fb375bbf5c199bfd5a183f8208dda50bbb8cda8e210bc3ae3e1a0fe621b3b92eaa88e8276876c0acdd7a7ca16be4f553c8d5217133360ec450d423177056

Download Submit
C:\Program Files (x86)\FanControl\FanControl.Library.dll

Filesize
121KB

MD5
d26f6eb5ff95acb3bd9063ef7e29851b

SHA1
a2e5379eadefb49c195735e027e9da4ee90de2cb

SHA256
1f2ab931f20ab08d47c76a8174ce44104f7a28a51242cc7f44dc11839160d46f

SHA512
ff7fa479542688cab773afa771a55729e80b73b36f217807b2d710f16c57bbbbb1a8fff7f0d4b082021b17978c35caa09e509e0c258e56e33cd5724bb9d62a74

Download Submit
C:\Program Files (x86)\FanControl\FanControl.Plugins.dll

Filesize
4KB

MD5
d2f54cdfb526b6b3891ac33d14a103ca

SHA1
c86f79382a0ab2c3a1b5460f0a3fd1ef9e5f3cc9

SHA256
37502192909adc3f8b402e55cb43b2337b8270d1c7d6646e97029f6c7686d487

SHA512
0823ae1c1dcc934e5e383ef0669704bbe608fb04d7b1624859c40bff7698114f3b3d32bcd22617aba302694f22046573f058ba21aa33cc6e9ddcc8ee71d58da5

Download Submit
C:\Program Files (x86)\FanControl\FanControl.Plugins.xml

Filesize
6KB

MD5
2f773bff374f0ea0afae2e258d20d85c

SHA1
d1326484a88039db661605f84b81ae944942cea3

SHA256
39cafaf34d0fa0652e7ef4cf2fcd119d1898d98b0574ffb78c4c643fbb1b542c

SHA512
42ff26e17bed662cee384dc0432603f9189bc9ca15341deb8c5b6cbf0a4f6bb25352a1a94ec5cdc411ecf339367a1a085e1d9b66ee61b578582c1fd4600d709b

Download Submit
C:\Program Files (x86)\FanControl\FanControl.Resources.dll

Filesize
6KB

MD5
7d30b16ca5116b5cd4e91e58cd359a77

SHA1
18bfd701de3f4dfd01de685fe8867b962337742e

SHA256
778217db8b52bf8f75234f5947a8435c23b5c82679ceb753f5ad01039fcd4c2d

SHA512
c47a766c393eddaae3cc69642bb2ca0ea8de5a828b8a02815a4810393e95d26342ec4ef0c384e6781f51db657f0b4dd940fe3380a3439f6d7f0c6bed7f068c8c

Download Submit
C:\Program Files (x86)\FanControl\FanControl.deps.json

Filesize
26KB

MD5
69c69e9c791d1be035f0b7e734bc34b1

SHA1
6d6de0f241175cd93c06c38e2f4406057f04f280

SHA256
a8ba8df748e6eb7991ff269498947b5e195a5476e8370e154c932d361c753bc0

SHA512
1bea580ad87afa128324b99220b353c197fad2229dc0c39a4c5e109341d9f0defdae78553287d29d1350c3609f5d26b93a2e75ceef1208a8f52aae5ef28d0c73

Download Submit
C:\Program Files (x86)\FanControl\FanControl.deps.json

Filesize
26KB

MD5
5bcc1a1c207574280ff7705c37d8e219

SHA1
28ff775740584ae237f82f33d354e1ca0ac1e876

SHA256
5f55a252dbdefe3402f63a08579b47b95d0dc7b0f8b1c9a92323582966cc2559

SHA512
e701df42774eb0cb025d4a1237bb9ab916fbb946428535118e7033893b536c342b08a96a6f9537991fe70ef8b354771524dc7968538e4e83c1c0941bbd93b027

Download Submit
C:\Program Files (x86)\FanControl\FanControl.dll

Filesize
3.3MB

MD5
65c4fab05e2dc87f028d1f244ee6d8ca

SHA1
e2a047d39995359ae2376014a04a1605c397eff1

SHA256
1548b9756ab3bad7df02328121f05572c2eb460b98e0feaa7ecc5e173cfde719

SHA512
d0a627f69714c59a82cdbbed6444d1ba4264e52e2bdaee2e28b354dab36e6f2b455d781037da6fd5b937b6f877f017445ca8f006eb793946f757a619d7704904

Download Submit
C:\Program Files (x86)\FanControl\FanControl.exe

Filesize
692KB

MD5
809a143dde18abb1db208a0dd875b4d5

SHA1
d988f6bd0741071d94732187bd453a04456eda0a

SHA256
56493dd014d3a3129f7fc070220af06ab49764f7ab58283ccdb5271cb569e3bf

SHA512
a5a9afc86ff1eb1ec997069e4188fc831e3d125c52fd6480a9ab0c5b9e84615fd792ead2819fdf5c71169a9291eb4f5c27808f092b40a41f92ea7d565898383b

Download Submit
C:\Program Files (x86)\FanControl\FanControl.exe

Filesize
308KB

MD5
abfb5feabcf1e97bb0a47f2ab4b05df7

SHA1
62d630dedb2ae457abba367004d0829a1ea9a2f1

SHA256
1ded7c9b60be18e81f751c9dd76ce7d1db0418e6c104b1542b7874ff1129e9a7

SHA512
6122fb993a8abf58ba9d2b11507e2e61043f8d3164d83ad22722dea676b8a323a63d4b4bb0fbc0f51c26150a4cba3cc7ca9b936cc3f07e164ec99e09ab81651d

Download Submit
C:\Program Files (x86)\FanControl\FanControl.pdb

Filesize
240KB

MD5
858dabe48e4ee22f23a8545c2e8e917b

SHA1
5ae8a1532131f4be47c05f167fd77f65251df2aa

SHA256
f1d52b8ad304b2287d90aeed009d80d65e81d599241f7e143c804ecf72ce719d

SHA512
d67c51f2ea3b579a8bae0cdef22764e26ac9b359498a10f00897ccd4751c20f2f5dd044285b2543eaa7846380072ea71fc75e8dca2870340e81b3e8231673f1f

Download Submit
C:\Program Files (x86)\FanControl\FanControl.runtimeconfig.json

Filesize
549B

MD5
4873cc0651726733b9391b9c7e109bcc

SHA1
f7a07854cc12209871f2b13fa26c6ed9227b98da

SHA256
dee890f66a036a6eda8ad3d91e0a0c26a01f5ef6047eec630450a037f194098a

SHA512
c62f2255a890caed8aa5a2301574deb7a8cd0ea296f93fb14a0f3d0ee149c797a905135c3e5dadca9986086f412cf87cd5f4fbe2dd3abd06f4f762aacf0ce191

Download Submit
C:\Program Files (x86)\FanControl\GongSolutions.WPF.DragDrop.dll

Filesize
190KB

MD5
7b2f364573e813c6c894bf99589cad78

SHA1
d17ae139b9e69211dd96c6378ab0d0254c7e2ad4

SHA256
67fcfc1c5fa95c2a5e137ac89e2f309ae700b4e3206478284154b31b18bf93bb

SHA512
b7225338262ff24da7f9cfcfea400beca7f098131e011e82e80978962a7b27a253ef6e08a25cca09067725cdc065ad84c66f87ca6f584fed0cdd1e45046797a2

Download Submit
C:\Program Files (x86)\FanControl\Google.Protobuf.dll

Filesize
461KB

MD5
cfc144b3752bf08efff07227f0e383ed

SHA1
29a5f4c1caa5190546024ce53b70bfe5ba990a7e

SHA256
d2df9df3c14ad31202b989476bd8a5e41f681d99d16aa6c48f29acc996a447dd

SHA512
00ec22a9acc9a08d667964f8f9c58d2ef36114e990b1318f5534fdf6f70f3052006b97454b731fbaa0c9808a3b43957e2293bcf061a08b2fb26ba77acf2e90da

Download Submit
C:\Program Files (x86)\FanControl\Grpc.Core.Api.dll

Filesize
68KB

MD5
b11101d9af7b04c46e6bc55a1d54b696

SHA1
c111825d1777aa5e50b31add93fd77bce69852c7

SHA256
62f5b30e46d75781c97f0533538b078351ec12929f461d35eb2df9a6b4ae4b2c

SHA512
bf37a2d844e3c2950624e21751b3e42509388a844f2534cbd99bd90d733d147b6f10ad1e2ed250cb0c5a78ba7f21cf00e873b90ec44b2a3c16494cb8cac0174c

Download Submit
C:\Program Files (x86)\FanControl\GrpcDotNetNamedPipes.dll

Filesize
75KB

MD5
b79a8ccd675bca11794bece6fe6ad351

SHA1
f662add0c7258751e740f405e051c20767805378

SHA256
f1d71b65eb1f0468e40b1c8fdf28f338f5393eccf494caaad9c98f75f818a0f3

SHA512
d2c062bf0f4656445d0a0e5cf769b57e39d8473807f72086262c7d5c6fe0b4a009724cd3739b01e751da8a8b4c978a618fc9684a4bc5ac8b4c8dcb90b398d870

Download Submit
C:\Program Files (x86)\FanControl\HidSharp.dll

Filesize
230KB

MD5
c5e3f63adbd63da7e97675748a1af866

SHA1
3b9d5d2ecaf89d53f762048c9ab942250f1a2cad

SHA256
61eb2e22a5620d789a23d389f1af9d38faff4d85f46adedbc28fb22cfec61bf9

SHA512
16dcd61b83032a3fd47cb36a400ea4d7910179a9735e66aad9b463daaf2626586756b8ca2e0aa34c5508e29f89e3bd78366ad60c5bb08e053e35dcf03d0a9d7c

Download Submit
C:\Program Files (x86)\FanControl\LibreHardwareMonitorLib.dll

Filesize
662KB

MD5
c447b2175b8bd195772dc40b9d15fd4d

SHA1
89dba6a17579f16e53daf531804d4137fcaa5084

SHA256
e7ee42ee56b4d488a7ea598b387ae46bf64c9cd83303975fd4abf29634cf697e

SHA512
d829a78fd818f76f0a74243e9e1c0e92b3f73029c6583f19c728dd1cb4d3a95d43190094a76c28c5d86e99b19a339e0b6e2ee8cf608a542e80fbf2879b34cd35

Download Submit
C:\Program Files (x86)\FanControl\LibreHardwareMonitorLib.xml

Filesize
128KB

MD5
4621134de7b898e8a0796eb3ae42bb98

SHA1
401a6b740e7b076d37eecaf051e96a9092721865

SHA256
6d4d8ee1529e3769215675a941e9901c417fb03ba7ab7dc35f649524af6f8a03

SHA512
50ca3744688f4c3813629d5c9c0e5c70c5f91e16f8331d81c06c15bc78629e98c46516e4799b25b743642c44a14c6c6174ac4f27ba9a65eb418e6a6beb654714

Download Submit
C:\Program Files (x86)\FanControl\MaterialDesignColors.dll

Filesize
310KB

MD5
680b97a82a2e97384b29f2b14c52a7d0

SHA1
33c5e38abfdf13a2aaf972ddd2e235c415e2a7a6

SHA256
526e9f98516e7a7066a4dc38f6fbdafd489863deb066085ac8e5556853ac2833

SHA512
bc1d30f2ab461e60e54f81e7ee030a8aad1935e29a82d00f68af6333a5f43e2780b1c3fb8ed88a21f07b33a174ddcf434c5a4af1b3130e930ab73502a0b02129

Download Submit
C:\Program Files (x86)\FanControl\MaterialDesignThemes.Wpf.dll

Filesize
9.4MB

MD5
27f73ae1925eff84a67f898af4f47e14

SHA1
fb9a43b248418def845e6ed0b051e204d6b07705

SHA256
3802400c5164f7f6fdea70e6b688123cc8eb7274acd7af632cfae4e437441bd2

SHA512
36ef68e3d6a87bc11e9ff3a2abb09fd8a5b7d800182f382dce975386e2fea1ce1f62d302c782667fa55e1c3b56c2862448b9ef4d4f3e5349f85ebf8b6b327f69

Download Submit
C:\Program Files (x86)\FanControl\Microsoft.Toolkit.Uwp.Notifications.dll

Filesize
159KB

MD5
337150c55ef9c107fe65e51ce4fc9709

SHA1
60a7acce3c339665e1f5fef99b8d2cd848436511

SHA256
e6676557727bc03cf7bceb1cb7b46ec4623ed7eb57813e8f04785bcd9d868b05

SHA512
aee99ab3e51aae4285e8a717cd2400db7826c79f0e404c37949ce944fc8aa1229e781a0851fb4b29c79052c5ae8b8b71c73006cff66480d150bba677c5abadf7

Download Submit
C:\Program Files (x86)\FanControl\Microsoft.Win32.TaskScheduler.dll

Filesize
329KB

MD5
f991dca7413cb6a9e28ed527205655b5

SHA1
d9e6ef1e9295ae6ee48daaba10b214bff9a6cb74

SHA256
3ef8d978dfb0a2611436de1872ef76abbb0f3ab1368bcd2bcd0bb584dbf9d60d

SHA512
036e0ed4df4bec37dcb9e549bd829dc988c6cfff74af75a988347065e61e3b010bc2a3874b3a2550428d6a34e71f087c195bb1e854f908355942bf7e1403b7df

Download Submit
C:\Program Files (x86)\FanControl\Microsoft.Windows.SDK.NET.dll

Filesize
21.7MB

MD5
d6cdb495256001b172c0a34d0cee05e6

SHA1
4db1ad3809f2615d7e985dbf9661a20a97bbcd17

SHA256
c067f73eb975b4c32bdb72ccd3de336ebd51174d7dd253514c9f24cb3368bd82

SHA512
24c56c3b1fd94b9775392974b17bc1b0bb1c600bbae75adae9a9ff8f3a7b5b4a73129e9a10ba5ff76cd6eb2ad33133bf2eea537a74254df5f11a7ea30c3f5e85

Download Submit
C:\Program Files (x86)\FanControl\Microsoft.Xaml.Behaviors.dll

Filesize
141KB

MD5
72f8adb8af71cf55ae3fa13afc72e877

SHA1
620b3c526997ae0d07171f14555ed22d58ee3639

SHA256
8f782ad7adfdeeaa933183065aa7a0be9387abce6038e912455e78527b04adca

SHA512
c0d73400b9e55952c1a70b844bdf3fecdd8fc55e3a9920c7f9a30e8def372422dadb2bb716570769037bae98d930c6bd50226f3ba3c255b823edbd67bc429c63

Download Submit
C:\Program Files (x86)\FanControl\Mono.Posix.NETStandard.dll

Filesize
185KB

MD5
acbe95839fec0179303fe17878f83067

SHA1
58b0e4c61fefc039c58691e728c73e225f22690d

SHA256
be0215d90462adbae5f03d6e5c3a969c9842a866b013df7a395769c5c352fa7e

SHA512
1361472ada3fa9a28b10be4d40f4d51c09a918139c97c1b88a413a8c30f12b7133c58c1db087421b7eee8436f02482ecd4393f9f0335a036711df4a1d9e61f9b

Download Submit
C:\Program Files (x86)\FanControl\MonoPosixHelper.dll

Filesize
85KB

MD5
903281527ef99e63fe55555882afb89f

SHA1
5ffc52328fe7551ca778ab4329a09ea9fc2288f7

SHA256
a57141b26d6ea3326b165bdcb15ca2bcd34737370f52358e12ffc8df41b92c62

SHA512
6341c571f965525c2d19c4ee159dfcc7c53bcb455c2c1fe889298cef05cbe5c681902d595893a2756d43ac21aeca406403c09387c231af80e16f16492fecca45

Download Submit
C:\Program Files (x86)\FanControl\Newtonsoft.Json.dll

Filesize
695KB

MD5
adf3e3eecde20b7c9661e9c47106a14a

SHA1
f3130f7fd4b414b5aec04eb87ed800eb84dd2154

SHA256
22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07

SHA512
6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b

Download Submit
C:\Program Files (x86)\FanControl\NvAPIWrapper.dll

Filesize
457KB

MD5
3f5cada05c523d08b27bb0936d868683

SHA1
e42a1f702926481b12d41e07dea06f3c893f4c0e

SHA256
b1a320d22b2a33a32a17ebe8ac3192f35eab0f4aaed8ed6ecfae99b0d0da98eb

SHA512
3166da72836b8cefb35a7c1bddcede6162697d62296b42ce53e703a93a286eb311249b4b61b7842d06bb524f973b7d7cf3fafbcdbc7d5ffffb75786756d0573b

Download Submit
C:\Program Files (x86)\FanControl\Resources\EULA.txt

Filesize
1KB

MD5
ca2bec7e34a6021e0cd3f3ce02b9b261

SHA1
f26572afe3c0f4dae052e8d2f5fc2508f2803080

SHA256
501aa9552d83b094d4c42e2cd268adea0dd59c8e3a085a72f54f898ef286e9c7

SHA512
603acca2390938114c25998d74732c32c260ea3087c020a58a80004b388dd616a7d92b08d9d7b63839675de87d494e2d0ccbdacfb1d31e9b2336985d014c7314

Download Submit
C:\Program Files (x86)\FanControl\Stfu.dll

Filesize
19KB

MD5
01b38b390da768f9fae21514b761a704

SHA1
7df7257d8b22488f5520223174c0e262faccdb17

SHA256
0db7d5306e67d0ca5a435272f2b7dc0a9eb77a6021c1c691041ddc0021f2a214

SHA512
756e3950c938a5039389c3742be2a951055621b0c3b5863acde2a3c8a41f83c0437a4387ae64e88b3d5f73c3807d4d29120942d5e961fcb9840377e1cc71cdc9

Download Submit
C:\Program Files (x86)\FanControl\System.IO.Ports.dll

Filesize
85KB

MD5
0b69fa39957837429423e83d049aaee5

SHA1
5b85c35235b443a597bd6092ed48fb463e01d3a0

SHA256
8d6c9b2bffe01741d1b4915fe26c93ba8c2382b00ee4cf88a312a789619ef503

SHA512
49d43130862aaf164885bdcb6f0b76325cf117c7281d84aae049da2c1ba6bc04a592798e5f70b9e8b16678a5513d0fd7cb71c2976e9c4f90dfcfa19df781af5b

Download Submit
C:\Program Files (x86)\FanControl\System.Management.dll

Filesize
304KB

MD5
e1422b4c04b923dcfe00a55290dc18a6

SHA1
0609ecde6bc8a87f88bc32b98d19800ff19529b6

SHA256
b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143

SHA512
297f54fceeb0cde17745323e7c41fea830a376fe9c3cf92a692c48199c0a05f1533a3045fd9c6d21352d084aa9ccec7b6cf630c7df49b52ed4025ae156509a7c

Download Submit
C:\Program Files (x86)\FanControl\Typography.GlyphLayout.dll

Filesize
27KB

MD5
6aafdc88f21fb9c294e65eec5dfbe27d

SHA1
c9212223b15d5620bf06dbbd3d46f5b42f98de04

SHA256
07d669821fac46f48012b6025a7f09abe666904f3a2f0973d4b435d411dc6bc4

SHA512
f3f01e439e6c516f533f327c98ce2510ebbdb240c63f5fd601df08eef1f522d74623f43b203b1a1ec472cc57a985f0c8c1aaa8754c10e0252eca542098041a1f

Download Submit
C:\Program Files (x86)\FanControl\Typography.OpenFont.dll

Filesize
640KB

MD5
f3af023014d3fe3ccb3cd6f9efc23168

SHA1
cbb4cbd43a0af7bbb1656796c303863104bcfc97

SHA256
023173bce8da89cbbdf0c1ad7892c602f8492a52c84b9a930d585b57723bfdae

SHA512
8b72811ce452b52cd8075537f62161751df99c522b08a4ba3a1bb74121e2de241d962051c157941e81e1d7732b5d9692d40729f5d6e47306f445e8077dcde2e3

Download Submit
C:\Program Files (x86)\FanControl\Updater.exe

Filesize
308KB

MD5
8bc3fb11c955e99e2ec5863884140484

SHA1
1756bd9eeb6f294d605cad119ba53b44c78f870c

SHA256
b6166e82c027463c13c40f0c99f4b9f232b0f3c673cdec078f317799d0e624d2

SHA512
c8b775df27c8e7b82679b4c1a14fd0e0b290ef5545cd3ad31e11544c2a5c65fdb87f7a120d1dab12f3f46e573f04d0b5fefd06b2a41f8e8d8fc65b415ba7698b

Download Submit
C:\Program Files (x86)\FanControl\WinRT.Runtime.dll

Filesize
389KB

MD5
0966745c6b954e7bbd15459756a106c6

SHA1
f6efa62a95b4f40c84341ed58c1d3c8d5af2111d

SHA256
4977a1e6dcee4c3310a68e20f2879cf39b95255e29f3fd7557781e058445cb9b

SHA512
ab8a07fdf72315ffaa49271faca6d0d6523b3480d53fd6f5225fdfcb41ee099e3b401872a684016ed02d347b48eae3467185b6e9dcd16994c0b7e3c562e9a047

Download Submit
C:\Program Files (x86)\FanControl\de\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
9KB

MD5
19f3a97f752fd9d5ca2d0f396ff83a3f

SHA1
ecd4c1f368d963e4a557d17996eff0bb4db2a70a

SHA256
58258bd7b852491b22887a49efa74a2ddf99f162374f1efc7a3c137615fd4a88

SHA512
c1ef88053e9255171ac035ee27cd1fe676fa30696aae7a2740409428633c9a52c7b7fbc35979e736f2e8bc20d19474f946b2d909d65cb9a0f0d73a5911814112

Download Submit
C:\Program Files (x86)\FanControl\es\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
10KB

MD5
cdeab974eb43d77f6bade325b13aaf73

SHA1
8dd4fd2090347cdf4890804192d6fd6b07054334

SHA256
daf21e7923658f10ee34be1bebce68872cc24930474bb275b570f99ff9cd8023

SHA512
831ee77fa644a929c159b2e05a5d397ddd89c6da588781ecde93efe41890650c78ab7a9eda08686f9bd9b6d32cb546202b8aa16c89321a86f71132b2bbf12e16

Download Submit
C:\Program Files (x86)\FanControl\fr\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
10KB

MD5
c6d5a977c7451a82704ac03519f0c694

SHA1
7ce180b13ed32c1c5b024ce585c4950e65f12809

SHA256
76ba09fba83201d690729ff48c65eece1fd835bdf920870b4dbc2e6c74ae9ba5

SHA512
f84adbf5da3525c4cee4eecdc8c51e1e43ab4e5fc918a5909ea1fb461fa4eeded7f40f7cadc9fefbee402d1a0cfe2a7cb2939345da56dbaeddc421558fd7e3a2

Download Submit
C:\Program Files (x86)\FanControl\it\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
10KB

MD5
bad880518a5d6ac9ef9719589ec6ed9e

SHA1
b953350ebba7abdde803d3a2f259a0bc35770af3

SHA256
d760a6dad79a35aa9283c00ac50b6276efc31e681620bb56a393af41d619c6e2

SHA512
194b038e4d5b810a50a42b36117be47f2ef6831654db2aee7fa2029afe35d7259ab110de5e03961c0aa9650ae9ae241f376950f9c5f5d28bf6ef360343cad587

Download Submit
C:\Program Files (x86)\FanControl\libMonoPosixHelper.dll

Filesize
1.4MB

MD5
cb1e95b5374bbbfc2ee5de174bfc03c3

SHA1
fc5cc699db7c6ecf1cf511219d9ccab88eb50aa8

SHA256
b16f77c155a36559a44da32e17e0bf63d899db0bb48c6590bc8eba7bb0ff87a8

SHA512
e7855e1675032eaf5cc7ba2c7fb43fd0dc1ff2ae642b48735da52d443dbe9486f6618e75d6d4b4171ea1f247195244428ebdbdcbb09228421985e1f299422988

Download Submit
C:\Program Files (x86)\FanControl\pl\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
10KB

MD5
8cd586e15f1d08e9e50d421202842570

SHA1
9b7398d8487c193901cdbf2c2165902ce2a0fb8f

SHA256
ff97649021c7e0240bd0211ef52ed1cf2b63e20c2663c894e13d16dc8622cc3a

SHA512
8d82eef2faf4f6d3c919adb5a4543d4260c7f37158e3a7bb689e0a3c8ec6321ae09db50431b38ddbdc3f2678bc0ca8a5d7e4ce7c2cb79b8bd6de1da5ece0f365

Download Submit
C:\Program Files (x86)\FanControl\ru\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
10KB

MD5
38e68beee1b1693d9c5b39a97620fa1e

SHA1
1590bef59022f0da275b2a62127a5ef0fdea3111

SHA256
4bb25b212e8deadda89e5ac589453b31b7ae6097210d3b7453a790375ed63f9b

SHA512
cad11cdd5c91a998c7f30508abe94f2d00cdcf8bdcc60cff3572a93d8167831ec46fd776d32a2e66f3dfaf3188938f43a8b9956b55ea4fe7211639920357cb98

Download Submit
C:\Program Files (x86)\FanControl\temp_fancontrol_installer.exe

Filesize
14.1MB

MD5
cd9cd75ecbdef20463d362a4bd42356d

SHA1
167b023a20f5ffd99fb8f1eed2eaacfb6ebfb189

SHA256
b925db4b345f69cafc2d801dc7584de4c709cf45975b33645171a958434fddcc

SHA512
d11c2e6057c1ec9ec9c304872a0aaa9da6197ce02cf0de8c24ae6ba01815f66284307dfd42c0127569d1a18d3e3b6ac35512d7563c1cde4a8b88939c51041221

Download Submit
C:\Program Files (x86)\FanControl\unins000.dat

Filesize
9KB

MD5
8fedc8994fe693da8d11505a5a135c3f

SHA1
4e66f8a8e0f178521a0d35058c10d5d9fb56f24a

SHA256
f42d4a48c92961305739af542e79907ae6e5fd4a9f8eb28c3b8f56f8cfc3ba71

SHA512
ceb96a1304e68dc5db01b2b25c6bd210847b736ba905c48eaabfd4d522be1fa1b6f0e3bf18bd04aa2646d7c53f63e90bcae993013bb0d31a71be22704db3141b

Download Submit
C:\Program Files (x86)\FanControl\unins000.exe

Filesize
3.5MB

MD5
4c1a4767d2374727a9309cf72cca159f

SHA1
f513c497b722ca9942222407f5a8c75aefcb88cf

SHA256
5f65c1744a4ce64a367b46f965493624a7d2df36fc5ef9a96ec9adbbb14f8cec

SHA512
e5b27cecdc5f5b61546f978e271a50273337a55e0da2096ec75de79bd1b48016554140ccdd06ec5c8d2bcda8a6de125e1e37f69d53eb4b34c3b70ead92e1df30

Download Submit
C:\Program Files (x86)\FanControl\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
9KB

MD5
042b6bd777278b8b3b23c7652f97fa5c

SHA1
de865eb6713424904bf5b52ea8c17ff119706c3a

SHA256
e113e86d569a6af8f5b73cd76813a157d6de1b3955a8756b01d758967393217d

SHA512
14ce5de1df07f765409286b0c723e242bb037c9dcc24bf966389c780593ca4e2b9a8eca2630d8325e5069b109925eda654a2b41bf6a83901c0cb5d265218f759

Download Submit
C:\Program Files (x86)\FanControl\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Filesize
9KB

MD5
367090557d5597a09728b6d264e1f190

SHA1
d54394a36de1b07c58cab6e24c9a52f4968ab4f3

SHA256
c7dfc9c3f931c19d502e5be2adacf71da4721705f72531bb93ac6b1423fdf65c

SHA512
b923bde529da23ab2ba52d68e76d602d6ad5373b801f4028927622a3ccb08a43a860a7b400f87490e593bd8b9182aa15dd4d0da5defb97b4eed194fef294b37a

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

Filesize
4KB

MD5
84650e476f4f087c90d822d91ddcfc96

SHA1
211715a090285b2b6d06b4f7352583494745d5c9

SHA256
9850bed074cbf948199a9f62ab4b792fdd7ff2a72b76739be2a4f75f752f6adf

SHA512
c6f6a0d8120f00f9ee7de26108317305e2e7228822c337f3aeb5d52adb9ba73bbb2e233095da4d9ccfe8e6870f9d972062e78e75378ba02a541a7cb4bf86d8df

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FanControl.lnk

Filesize
1KB

MD5
46658ac772d79847c6577404ed507a3f

SHA1
cef4004f365a5d4b46795f9a6ad6f5f88119d340

SHA256
5f3078189b890f2cadbb09b90ef223733525ced8d40bd59a326a556fa92fbdfa

SHA512
a92eb36950bc3024c35b309aa3d161b357954510ffa6686e0ccc5746a84b46bbe33153f86aa9c3f8a706f5c16ccdf23cf93af6d79a66b6de661df11137f9e7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b0c53c5fe6ad2ee4ffbde1b3384d027

SHA1
0c9ae4f75a65ed95159b6eb75c3c7b48971f3e71

SHA256
2e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f

SHA512
29f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe63f44aa3aa9393e4251b4b74226e3

SHA1
29eef15e4d60afed127861deebc7196e97d19e4a

SHA256
7787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3

SHA512
f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
7d5e1b1b9e9321b9e89504f2c2153b10

SHA1
37847cc4c1d46d16265e0e4659e6b5611d62b935

SHA256
adbd44258f3952a53d9c99303e034d87c5c4f66c5c431910b1823bb3dd0326af

SHA512
6f3dc2c523127a58def4364a56c3daa0b2d532891d06f6432ad89b740ee87eacacfcea6fa62a6785e6b9844d404baee4ea4a73606841769ab2dfc5f0efe40989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
de01a584e546502ef1f07ff3855a365f

SHA1
60007565a3e6c1161668779af9a93d84eac7bca8

SHA256
9ed00a33812a1705d33ccf2c3717120f536e3f4e07e405539e1b01c5a38a14ea

SHA512
1582b69b40e05bad47f789e1b021cdd5e3f75548a39a99e0db1b15138425e530e25ce6e56185b1dfa5f51758d2709e52d53f309da2e662ebc34c8d4974ab6469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
c71e53854f68266b9b7f2151cfcc5c32

SHA1
356fa2aa7d9a8c7585d846fadde297d33166ecd6

SHA256
ba4913f000f60e3762611198396ef0bf07204cb4381a74d83328e6369eaf39b5

SHA512
d261f7efb5490d0e9e11517d1e96d8d090bb0a64584565afe335ab9becb54f399e5eea088156c999004b771f4cabaa107256822bc1c4085194a35744d7915270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
768d928843192602160a485db8932745

SHA1
e074afd8726ad9a2df8bba9451fdb25e5a7bc476

SHA256
ab051da9029f30b909c669ad82405ac394982d95b092a257ef4cd6749c88101a

SHA512
c4c1381452384bc809b371ca6b0c0eefde4f32cd343d720318b5dffb3774bcde17be0b315b29c3e7268f000f0fc5ecf490b696a4357a9d142d0eae97f599d727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b23894946a68d2af336d19051b6743ff

SHA1
930357e9f3051e01f5fecee9869edcba7bb84b74

SHA256
f4042b2648aa455ab0e82fee51af33078ff0b787b2ad90ec2a586711ac5df99e

SHA512
475c3064280d90113d3596a3a221f75e1ff802f8b257a64530a4bd6eb6bcb9c36c2a496facd3179b5bcbfe7f3b8fb76de8af1d24514e227a6c21d0c7daa27fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
ca66465c5ece83df3368be30918f0056

SHA1
790c14431087ae1e81e347db4faf16d3ca80f25e

SHA256
21da23ac5710486636016bf74ee3e1d390da6cd6a46fc5aa3a47cda9f3c090ea

SHA512
00efb2682fb516dcf306d0e7e36dfe85f7cafea68b6c368d70389891952925374ce4d0c9cb88c7770933d038610afac91d9a85f0b915ed178b84bbb3d05e86ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a91cb10e11fbbeea280e5a158abd126e

SHA1
29d48df91def4dcbc85a29c2f684c91beb535805

SHA256
e98139a79fc67f73cfab9269c91f0f2b377789212d8ff812be91e787150ad25c

SHA512
8b0ca53b564dd2a16f24f1403a244ef9655834b6b70562378c65994864a6505442be2b1ebe4d3e568ca71611b68f15192401e26554765750f616f2dc7f24a931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1d91c1cb0f8c5714f2a1997f41c1149

SHA1
5f6bb00d5095656fbef0dedb1c21a2c14516de2a

SHA256
292941e20a02de3464e8bab813e5e14346dbdc42feb3c8c8dc329a773bae1a99

SHA512
c6c8af704b65d06ef24174d5bf8d96d1527b3cfd8c30a31803ad795cee0e67373c77099c3ef6a8481d0b10bd209e2d4f61bf822fbaeb066eb4a7f53bdb0dcf73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25f255c9df610cf02ebf9cf3116506f3

SHA1
1f2493207ce21cf61dbbdeffb44ac9f97cbd80ed

SHA256
f75ca4b619050a2214b48bc2616b47ad61c8407cb9f53ebc91e52f585ef3cc67

SHA512
6e9a17c45a8d00eaf66f192eebeb9b37dd3c2f402f4d7159bc88db85de7a5d7a21c00bc73ea6f49c7d0ce3a8aabcc253c33b97c8f438a3430a7ed2115240457e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3efdb547434ace58ba7b434f54f1842

SHA1
1ba32e4c00378744089b83105a477533d09eed66

SHA256
1dad5391ec942e72d8de3eb9f10795afe2f28c33c9d90f77e3c53d5d49b58d6b

SHA512
55818eefcef081529816e9e59a98c2d3fcb9e4a95f7cc9e1cc51cbcb7157190b3995c0c14a4d0270d0a9382780710ecc3525a23240f63760d96e93524301ce9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1808b8c2e8b6cc7016efbb91fcf67264

SHA1
db75242b7a3fb1c43819f9fd3012cb8900f22e01

SHA256
8fc59540c240767feb6cd08489394a7849545ce92d31c8fc01220baf3ae15455

SHA512
2e671426f1f75a256ff17a8b88615baf14bf34f47435e7b0998ee8268db36a845124b03a5caca1be93816e49abd176ae4c16b1e25bae443aa0181d82af51561b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e27a50e7918f25f4ebcbdad2d5707bda

SHA1
0190e2166af153057eb670f7ccb6e6391f0f8ab8

SHA256
e1648660e6d94e12a8b23b4001f49a7a1cb540ec4cb951a55ca20829ae7e7001

SHA512
33a156c875412bc6e1e5c2f431bcfbad3feca1e0de99ace5ec2d1971593874f3ca071ab37d7b3eeb24270b5663a1902bf9286a013a92f83e6e68f1d414256d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
827bfd46fd0893ff0a31afc563f9930a

SHA1
74be7112bed5a9eeb04f5fdab558bd5196f7fc79

SHA256
1cb69acb9219fa216ff8895257fc53b22b7a9b808b635834dcf687729df33f73

SHA512
cf0fa026ed917855b737a91bbe3befe9c84211cd1ef5dd9004522a732d84c4b0c3073117c34b40891a5996bf343e6f3541bce5e0ca00e24ccf5891673a4fadc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6691853f88c2eede16e4eb94433a266

SHA1
a5137c37e62d34986491a742d9ce7ba0b92872d7

SHA256
86f7bbf85af1f9f7088fd61b96cfe634a43599f70b94d6d313ff531eabc0adc8

SHA512
f3ecc5a5f4e8655ab16f9565ce0be6383d7d596494ba74c1bb30f2aa634d7bd098a3ffbef7e8324ce4d6d8e5a07bf142aeb211c38ef5da67249265126b3459ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0ccd98243e56acb5f31d08fe76d2711

SHA1
a938864be1ab52a9e71fd68e50cbbb0dc43de9b4

SHA256
e752ad90c66da2271131ddf3fa6cca8b8c1282ee95185e867f3345b3886cc407

SHA512
27fb02e78839c8939a411e435519de7f65389b8af24736da5d75ec29a109f42598103fe8211a4208c17178c80e94d8c02fee0b7dc26f580b00b365b47935109f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1964f19c7b5d3bb0fe7e97f9a7de1a4b

SHA1
b4bd98585e64c98279d001060fbd9188c284f677

SHA256
435f2c9cea6347b7af5e9090b5401e4d179483c2689a5d70825726e85719c15b

SHA512
e3bc2059d1df0e17f242c28bb51aca996757fe9a6940b44f408c705642b8bbbf52b78bdde59bc4aa432e328ad1cf02a4fe9af1dd3d60e7f905078b7ae5b63b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
56226b70c9624bb6dbbae23b142cb0c6

SHA1
94c35f9a7a5331420126c9c8870dfcd982b4fd2e

SHA256
ba74a998864fa8a0c3771cc864fd657eed96a95b5a1b1c5b2ecb688547d945e7

SHA512
fbf52b0c04b584bfdd3db8311495993c3168a53145cbd443d43226c6263d303b905170928a6afd30e53a5db2fc534343ef4af34640f8ec991084631462a1b7e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
120cc52cfa5f9c1c6734c96b05757873

SHA1
52bbae9dcb4bf7e0d813cf898fa7c2abd396903d

SHA256
32a7b8e06e9f70b6810124b37d27f4a8640f6f75c5d5b5b070e0114213c442b6

SHA512
4f38b4f50c8b3dfc2159da2bfa029e960b67e8e657f5f6d35951f779d1d62322f364c888a8dea20038e33abddffa5897ee5129db1ecad232e3278bba8902602f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
de6a07844ab38b5fc88ca865e935cb1c

SHA1
4e318e3d49c84c9859dbda1a2ca3275b15a57e8e

SHA256
ea30f0e40c261d4ea91049723cc683573475a04f773433180f9b0b731f7a4c6c

SHA512
e510e6e150d06cb30affa42c416f508044209930978cd13165e47d6754c9e8aebbfbe5b7dd48ef61f05015d34ff6ab66f2654839d946f8068ec4875e19617a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9fa8444857bc510f586ac74eacc9d8c9

SHA1
976bec2ad2945887557a0f262a62557d84959829

SHA256
779f2fdead37ababe566c601a203afbe7bdbbde26d5114bd614091d857a7fdeb

SHA512
9647433f2dbb8613821e4d1c296ea253e0d8ff19d3e73f64e7eb00697b88780ba135e43e0db05dab116dc355f9f2645170d240522925796cee224ee720c52b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fde4a5fa1913f1d97a9b91d2e845f6c4

SHA1
1b11f05824327da7d96d182f1bc703bed996dbeb

SHA256
6a39164324bee38a0c7d062ea54b6507498ef381f0046a14d46974a1ba72820b

SHA512
f19d4ca48259572c0b632465ed709b476449412774279d75179a3c2e5b1809d5197581f099ae03a60016e4ba47671321984c4b8e436f486863fb859ce9c877b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f2dfd0a1481eb1849db929d39eba449

SHA1
be0aefa857a960dede2013fb78ddce194654f015

SHA256
36d910fbbf96abed8a313093fdaf692b74b6b7eb9de32ca139fb5b83930fbd70

SHA512
4a1206fb8c891d2c4471b662a0caf64904f57020dbe16cdcfd2c68b7a3f06e28536221f3e43c785e2458ef60dfcd6859f03ad1f916ac32f068bde9fabda756c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
912cb48ed2aed8fed772efa3cc0e7a7e

SHA1
423eca2538479c06489c0de6b372407c6ca4a3b3

SHA256
efb27ba5cd2ef32b88917287f437fd8229cf32b8c4ae4faa147e441c5f80238a

SHA512
fd0304088aab0e7f22fad92bc80e02a68976c89e6adfb64ec98ed109f9bd0ec15938071105601f06082696719cf0b7cbfccc3df4cbbfcfc7cc8b8f863f72565a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad542489adb9ae927d0eff6a07ba5f26

SHA1
35721b742a1b20596f3a8c0dff3a70a4b1a23a32

SHA256
ef23c18360f064bb67569445e7dc29e0780351a08bd19c72cd2a6f09dc4c8984

SHA512
a9b1e940b369de57700efa206dcd6d14ed2714856089a357dc920b60280920f049a8b58ef5a49bc55770e9892b9fe9a37eea12d4383c1ffd183271a49a0d89cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2daa2bcb91d63444cce4c82eefbc6499

SHA1
4a8c366fc1b5dd16c305c8374b1f26f527524a75

SHA256
659370b6aef318e325e33d8988cb99852f71b007cb99784f7b7c6836382fc32f

SHA512
983277f1cf8cf892cc490ec159226d2b3652210ac68acc3c60a0ccccaeb1883498d34af49fd89e1daf3469b2ee54216fa41602604c2fe7ad3277c5730707d6d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c6fd7aefcd0ce3a6bfdfa66e8cd388b

SHA1
a709882e2b4374e27ff72a4b0df46189c83abc33

SHA256
5411a09bc494bef89e7f74e670901d4f4b1b1e1b8ed0307581895baf222338c2

SHA512
83930591c495db94253938b8922bb85e382aee43364621526ef9e9afbff7f374a184f9beb3e295e9c388c314d07a03c710c7ee3ed785d7768559b026b9c8527e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7f3b0fe72d82e0798ec05e5cb63d99d

SHA1
1169be4372cbecc8118496bd67797c0d37a25bf5

SHA256
5d6180dc2e0d510cb618c68079f369a700f8fd45d2d116ac5b1fd150fa35208c

SHA512
b161ea6bff948a08e4bd8b78063581906998c3ef32e66b1263a0c65aabc21f15fb4e57c51490d9ef6c69861e88381d4034db1237306d4f3bfc83d183ac96a00b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f96437357df96c2445150b90b4c5d3ea

SHA1
165a1555d110eadcc0d675997fdbbe823ce0a0f5

SHA256
06b2203390d4e932a8697a32cd9b72c855676ead4eaa3a799ae34e16de4ab984

SHA512
7237b9d57056c4b9d04a93afdb5dea549de0183aab8510f4a7ba42aa74b47151971ebffbeb5b113629d2a7f80d9b25876f1f2beb27acb0b32209161c3b7231f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08668e9f393439f17998d5b035ed4a69

SHA1
4c6f56c48c1632685acc0257a92d044b0d9ae381

SHA256
9fc5e6b01b4b77de4d605edea0451eaff7629dd59f005fedd0da4255ef1e3899

SHA512
697db1c2d6e474884fe9a71b88b046806682df9c0e7790421200e64fdd24d49e2295b433ea935f9279cce780f1e8707f0346c2872f95c44fc2c0b654745df6c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bf4557f5dfdde7fd4c6b5f2ac220b99

SHA1
f76ae6aff1cbc4009327db570f8371e7110d0bfa

SHA256
f7abda972256f0776308cc3cf7e488ddebbc296e48ab256623b17975e10224de

SHA512
e99c1a5e9c607276f5a0cdb1d9349e76ab28b05fb9884ce3d23a0612f9462a38c0cd0b2a5f2d5f71a57e0a91c854f3dde234f0ebac2e810aae82952a33ff0f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3209a8bb2a3f577bc97872c6f25e3cd8

SHA1
d11e136ce55bb2b43b63e3660954f10ba8daacb3

SHA256
fef97bdad821866ba6296d4b228b04bc85faffc81bab0b8b87a734715a44b999

SHA512
d3aec1cd94c88feadc2a7bd6157e8e10f9b2007ee485536851f7a9dc80c971745b60465ad9c09e1581e98b57f6d900474166be3e13a69be76efacb163475752b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c06533543ceac5a94e579afe237f2379

SHA1
8458c573bf446ddc37e8ad53d2099c3062fb83f1

SHA256
8d1f7967d4f600ef6443026fdb9caf8fe36aff22d74b132ee49686bc3476dbc5

SHA512
f259e4f220c19a455a97fbcfa6e24bfc6c76fc84fc17d6938b0d14cb3581d9d721d2e1bc9ed2d8bc7e3f0429bb156e6389a7c72c6ff92943b02ce7e40552d336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b2f6969767b7b293781c1987177bdab5

SHA1
a4f5d361a68ab41cd8cb653d7533c59f97f242cf

SHA256
d36d0cc8d0b649de3bee05557bcdb6d3054e3dbd282ae42d0ed32b7b5cc90bd5

SHA512
037e8d12188e1f2b010583cedf8bde41ffa6f4b1225e7fc7e0b72b9694028a6f0631c91efa67e8863aa1d8328400adbf5e73903a29893438e40e133734df6cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
898e752aa621cf9998fa58e103948afb

SHA1
37ba7cbc360dca70ad106027060bc84ddf579502

SHA256
bd8eafe6f9901e14f44d1516b43bbe3521be493d752bdd8e0f408e1b6e9204c9

SHA512
40115ccd71a7c820d8c8a5a3d1055a702778d5b1a7d24ffa4020097a2f4a01cf5e175ca4f6eec146f3b29b09e553add8d2f63303e945a582cacaeec2e21b24af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598a54.TMP

Filesize
538B

MD5
af13e8314cfc36d0a28577205cc1157d

SHA1
6cc9ef36ca1c5c52f8566f9570861bea162c22b8

SHA256
d052fe8b3e1053539af11d659209de0025f2c89c57e47a97a063fdbb0a77a585

SHA512
e3c62a6712b1333365c54e4d2f49e6049f89821953e82a82a7f664c64e8f26a0d8bfb9eafbae22b4420c22ca2796f037c746632aa7e7bcdc2a76130cacd9e16e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
63f36cbe94aefe62182d40891f9c21cd

SHA1
60cbaa10d72d230637c5c9207bca3926141d11e7

SHA256
9ddfa6182750a21821e11d519219076ecd9f929b19f123490b2e34f26b756f4c

SHA512
2b245c3003337298bdc094f0f16992379971df1f305459fce1bfb90a32b5d6307fbf61c8b293f748999fa8c28c1bd6b08fc75a2fed2b5a9b8c64b6a777d2601e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3ad51b1343a974b448184dfc8089a3c6

SHA1
a72bb8916e4cfffed382724b2ee5a6dd7ad110d9

SHA256
f169e26667ac0c03dcfc44ed394afc0208d0566cb58239ec399d6fd279e8d069

SHA512
8b8af7b3d0c6b7485b79e552d49d3478d34c4c25fcb45349b8781193d7dfd64b5c1f4e0b8202ca3cb1ac2eb9b5f3fc0baa633eb009523bbddf0ec7087d087ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7cd50939d9d6deedc6eb89de9757a142

SHA1
528449e97239d102d0e9db5ff8c8ef54be1a05e8

SHA256
591770cbe20df351be99b70d0ad13f7400a68b8214cd3f1a14144ecb2e908935

SHA512
60389ab8435b1c48196fce74fe128616ac96c84940d50ac4bb3b3dcdcf3417696e8b7bc4db2ae6445eef3d616c19870bfe9e836a59b7ceba53b3838a3ad3c760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bf3271d0288c8eb7df0f177579180484

SHA1
5c5771fa0d7decf7500b36b5e3d8b2da3bb261ae

SHA256
2a493fdca14a401d9aec2b51ba2888c232a3e2a5ca50fc455fcf59b0d225babf

SHA512
441824b787d15bf7708322e1bd94a90921d144c54de442cda9f68eaf417c769c5a58caaa3eb9f77225dedfce92e6ecd675ddfedce42f458335035801e5ed725e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
249f21e7bafa97efff181b935adf010b

SHA1
32db37a7dfd254361a83c085ca57442411684ab7

SHA256
731d1fd628d1bc1692a4fabfb7dd0360f1f39a9cfa3c122c40cb3bd5d7f43a0f

SHA512
259a4699ae828d222b78747d82eb7d2f4094735cf12122b397b38d23cefe17d6adae889892cdcbe2910424dd8b213d9304ed6e0db7865490a1703c3bca7de8ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
439ef030369b587c0290474d4c0e72fb

SHA1
eb55dde226b5461e3c6caea28bc28ad93164becd

SHA256
a16ec766819158dba6e717fe837c4c02cdeb04d5cd737fbb1e63791c49f8258a

SHA512
29b523abec94162b3b81d8921c24c555ce19c0cc4cd4f8dd62b5e0c1b217c8ada79f1f99d4b86b143f5ee924443df1a3a098af31fa479a580c2f8604c46f4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
21e460d5bfcc869e86face28f1ca395a

SHA1
02b3b6017e4f0215abe4661aabb78a475b3827e2

SHA256
d341ac35a1eac751fd1e8417148b8015ac1010a15687c809b44ba26e5751699f

SHA512
e2179c18317afa272c2d5ccfc3d276e0ae806ed366f0fa9756f16a55105a17467b21127fa2652d08f404a65102d0e749803a9bd90b6eef2c782b0f6410077069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
be18a081b82db6a247e9fe0b152fc2af

SHA1
9b7925e186b387bf2a79b7918a7b49143a63ce68

SHA256
4a7139d70ce7f99a6ca066d1bc2d8a15094e67b9ab7bdd579c89c8ce27691817

SHA512
52033d9f64cb5974efb626cc58d097b9e18c2d9f48cd0b4ee9f1d8bd840f158ebb063a15ff665b0c5eb765094ee478d15dfa58bb02cba0d68570147d7870d0f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3ed48ce-7ab0-499f-8023-e2f49d7936a5.tmp

Filesize
11KB

MD5
553ff6fc3fd86467fe1b7125c2cbcf87

SHA1
032ac45121b218652d7620d43f2fd58ba7046ddb

SHA256
4981ce3ffd040ba310e1f0b9db0d33610bac54c91546d6d24fc303d8cee708dc

SHA512
a5fe452c13008b82b5982c0f1753f3aadc9c4668c0468847cb70c247d38adcd1c6b1b846d3d5eefbdf8821262d6bbda95b9563ddec963cb632b336923057bd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
732103e603b2e11be723a759644a524e

SHA1
be0fad07952404f9fe37de343f6f74dbd0f6a0df

SHA256
cd99c0ffc0bd2e4d3b76ee00910ab685fae031b7e8ce8f1003e550537fb43f75

SHA512
df56639fd4a3bc0d2b9d9e8589de234fc578ee095308682e869da464f098f68b8e2b473aeabb63e9fd01641de12f4a055531ff8b2c133e6c8cacde70380c1c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3NI1P.tmp\temp_fancontrol_installer.tmp

Filesize
3.1MB

MD5
d324dc0dcca892890ba16b5b1280b1d5

SHA1
f52010c4f0717afb2a4f24d3358fd815d1149e80

SHA256
339fee7b8e1a85b2027ff402d8644aba8c30f36f365c818ca5c1f89845c8d9a6

SHA512
ca28e66f705259e23cc4f2e315eee951d9a9491077ee43dc7fcbcfa462c72f2c529dad8363dcff8a76821a8073f56f13fa307237e26193183961e342428ade04

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6D9KI.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FNP16.tmp\FanControl_193_net_8_0_Installer.tmp

Filesize
3.5MB

MD5
8f2e1c53fd457d66679686bcb6fd2645

SHA1
3e82d384022e0b9c14868de7d40647446bbff883

SHA256
18eee38229d5637e3e4d535bf175cca87245fd0d635cd0e2c02b4747208b8ca2

SHA512
77c561fdda2fd4e903d451eb652ea744de54c567268114029ceae707f476fb21db14426348ac6c0c60ff3a92e084e641b806d44cd01f4930508a0d81720d49db

Download Submit
C:\Users\Admin\Downloads\Anap.a.exe

Filesize
16KB

MD5
0231c3a7d92ead1bad77819d5bda939d

SHA1
683523ae4b60ac43d62cac5dad05fd8b5b8b8ae0

SHA256
da1798c0a49b991fbda674f02007b0a3be4703e2b07ee540539db7e5bf983278

SHA512
e34af2a1bd8f17ddc994671db37b29728e933e62eded7aff93ab0194a813103cad9dba522388f9f67ba839196fb6ed54ce87e1bebcfd98957feb40b726a7e0c6

Download Submit
C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 11667.crdownload

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 140507.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 140507.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 177.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 359849.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 375199.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 538337.crdownload

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 657959.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 713157.crdownload

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 845606.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 865515.crdownload

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/1220-1413-0x0000000004B80000-0x0000000004B9A000-memory.dmp

Filesize
104KB

Download
memory/1220-1409-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1452-9764-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/1452-1252-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/1452-9762-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/1452-9763-0x0000000005CF0000-0x0000000006296000-memory.dmp

Filesize
5.6MB

Download
memory/1452-9765-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/1604-9612-0x0000000001500000-0x0000000001508000-memory.dmp

Filesize
32KB

Download
memory/1604-9609-0x000000001BB00000-0x000000001BBA6000-memory.dmp

Filesize
664KB

Download
memory/1604-9610-0x000000001C090000-0x000000001C55E000-memory.dmp

Filesize
4.8MB

Download
memory/1604-9611-0x000000001C640000-0x000000001C6DC000-memory.dmp

Filesize
624KB

Download
memory/1604-9613-0x000000001C8A0000-0x000000001C8EC000-memory.dmp

Filesize
304KB

Download
memory/2384-9401-0x0000000000670000-0x000000000069E000-memory.dmp

Filesize
184KB

Download
memory/2544-178-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2544-322-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/3184-131-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3184-1-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3184-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3592-9506-0x000000001C630000-0x000000001C63E000-memory.dmp

Filesize
56KB

Download
memory/3592-9505-0x0000000021C00000-0x0000000021C38000-memory.dmp

Filesize
224KB

Download
memory/3592-9504-0x000000001BFB0000-0x000000001BFB8000-memory.dmp

Filesize
32KB

Download
memory/3592-9492-0x0000000000640000-0x0000000000AA4000-memory.dmp

Filesize
4.4MB

Download
memory/3792-321-0x0000000000400000-0x0000000000730000-memory.dmp

Filesize
3.2MB

Download
memory/3936-9727-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/4100-166-0x000001EAD82E0000-0x000001EAD8808000-memory.dmp

Filesize
5.2MB

Download
memory/4100-161-0x000001EABD100000-0x000001EABD154000-memory.dmp

Filesize
336KB

Download
memory/4100-165-0x000001EAD7BE0000-0x000001EAD7DA2000-memory.dmp

Filesize
1.8MB

Download
memory/4100-163-0x000001EAD7710000-0x000001EAD77C0000-memory.dmp

Filesize
704KB

Download
memory/4100-164-0x000001EAD76C0000-0x000001EAD76E2000-memory.dmp

Filesize
136KB

Download
memory/4100-162-0x000001EAD7710000-0x000001EAD77C2000-memory.dmp

Filesize
712KB

Download
memory/4312-6-0x0000000000400000-0x0000000000790000-memory.dmp

Filesize
3.6MB

Download
memory/4312-129-0x0000000000400000-0x0000000000790000-memory.dmp

Filesize
3.6MB

Download