5dee92abf17b9a96ddf1a65ec08038f3193899a4c5a8c9ad1270b75ae31c1183

Analysis

max time kernel
228s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 04:20

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

baritone-1.21.1-20240826.213754-1.jar
Size

1.5MB
MD5

81b7cea89fcedad33a8e8c4430fb23f5
SHA1

28d660c9dcd24208b03029e4c36708a62e49e6c0
SHA256

5dee92abf17b9a96ddf1a65ec08038f3193899a4c5a8c9ad1270b75ae31c1183
SHA512

01e523774fad78af4b383d55eaf8b5a568c5afa97694b20dba5630834a0a62858ea4c2dee6be69e378ab13424de53ef569833924ad79f0f357dcc0fcc221e8cb
SSDEEP

49152:6UgAWlNH4wmEcFGcQrA3FTPQwl+yjrQYU0tJJR:pWlwnFt3xowl+yjD

Score

8^/10

discovery motw phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	GamingRepair.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe

Executes dropped EXE 5 IoCs

pid	Process
6780	MinecraftInstaller.exe
396	GamingRepair.exe
7032	GamingRepair.exe
5880	MinecraftInstaller.exe
3772	GamingRepair.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
396	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GamingRepair.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6900	sc.exe
5208	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GamingRepair.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	GamingRepair.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "242"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{01519E82-64F5-44F7-960D-A221536276D2}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 142208.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
2600	msedge.exe
2600	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
4892	msedge.exe
4892	msedge.exe
7652	msedge.exe
7652	msedge.exe
6568	sdiagnhost.exe
6568	sdiagnhost.exe
7620	sdiagnhost.exe
7620	sdiagnhost.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	6780	MinecraftInstaller.exe
Token: SeDebugPrivilege	6568	sdiagnhost.exe
Token: SeSecurityPrivilege	5236	wevtutil.exe
Token: SeBackupPrivilege	5236	wevtutil.exe
Token: SeSecurityPrivilege	368	wevtutil.exe
Token: SeBackupPrivilege	368	wevtutil.exe
Token: SeSecurityPrivilege	5168	wevtutil.exe
Token: SeBackupPrivilege	5168	wevtutil.exe
Token: SeSecurityPrivilege	5172	wevtutil.exe
Token: SeBackupPrivilege	5172	wevtutil.exe
Token: SeDebugPrivilege	7620	sdiagnhost.exe
Token: SeSecurityPrivilege	6900	sc.exe
Token: SeSecurityPrivilege	5208	sc.exe
Token: SeDebugPrivilege	5880	MinecraftInstaller.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5772	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4300	2600	msedge.exe	97
PID 2600 wrote to memory of 4300	2600	msedge.exe	97
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4244	2600	msedge.exe	98
PID 2600 wrote to memory of 4784	2600	msedge.exe	99
PID 2600 wrote to memory of 4784	2600	msedge.exe	99
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100
PID 2600 wrote to memory of 3872	2600	msedge.exe	100

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\baritone-1.21.1-20240826.213754-1.jar
1⤵
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf7e046f8,0x7ffdf7e04708,0x7ffdf7e04718
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9336 /prefetch:1
  2⤵
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9408 /prefetch:1
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9440 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9692 /prefetch:1
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10004 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10148 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10372 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10528 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10548 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10896 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10908 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10996 /prefetch:1
  2⤵
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11280 /prefetch:1
  2⤵
  PID:7312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8028 /prefetch:1
  2⤵
  PID:7728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:7892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:8128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11372 /prefetch:1
  2⤵
  PID:7848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9976 /prefetch:1
  2⤵
  PID:8116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:7400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:7464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8872 /prefetch:1
  2⤵
  PID:7440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9104 /prefetch:1
  2⤵
  PID:7468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:7480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10036 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9600 /prefetch:1
  2⤵
  PID:7076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=11400 /prefetch:8
  2⤵
  PID:7296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:7424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10884 /prefetch:8
  2⤵
  PID:7000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10368 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10884 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10652 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10656 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10308 /prefetch:1
  2⤵
  PID:7824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8556 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10076 /prefetch:1
  2⤵
  PID:8072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10400 /prefetch:1
  2⤵
  PID:8080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:1
  2⤵
  PID:7568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11328 /prefetch:1
  2⤵
  PID:7552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:7572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:1
  2⤵
  PID:7580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9496 /prefetch:1
  2⤵
  PID:7448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7652
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6780
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks system information in the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:396
  - - C:\Windows\system32\msdt.exe
      "C:\Windows\system32\msdt.exe" /id WindowsUpdateDiagnostic /skip TRUE
      4⤵
      PID:7256
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5236
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:368
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5168
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppModel-Runtime/Admin C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppModel-Runtime_Admin.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5172
  - - C:\Windows\system32\wscollect.exe
      "C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
      4⤵
      PID:5228
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y
        5⤵
        
        PID:7244
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y
        5⤵
        
        PID:5612
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y
      4⤵
      PID:5284
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y
      4⤵
      PID:7608
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_AppModel.reg /y
      4⤵
      PID:6484
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_AppModel.reg /y
      4⤵
      PID:3196
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_Appx.reg /y
      4⤵
      PID:7908
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\ActivatableClasses\Package" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg /y
      4⤵
      PID:8000
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_WuPolicy.reg /y
      4⤵
      PID:7404
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y
      4⤵
      PID:6904
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y
      4⤵
      PID:6876
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameFlt" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y
      4⤵
      PID:6640
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\Xvdd" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y
      4⤵
      PID:6676
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg /y
      4⤵
      PID:7760
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblGameSave_Service.reg /y
      4⤵
      PID:6124
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameInput Service" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameInput_Service.reg /y
      4⤵
      PID:5732
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\DoSvc" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\DoSvc_Service.reg /y
      4⤵
      PID:5820
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\InstallService" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\InstallService_Service.reg /y
      4⤵
      PID:8024
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wuauserv_Service.reg /y
      4⤵
      PID:7652
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:7032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2400642173603496887,17893344604048375831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6568

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7620
- C:\Windows\system32\sfc.exe
  "C:\Windows\system32\sfc.exe" /scanfile=C:\Windows\system32\Qmgr.dll
  2⤵
  PID:7516
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow bits
  2⤵
  - Launches sc.exe
  - Suspicious use of AdjustPrivilegeToken
  PID:6900
- C:\Windows\system32\bitsadmin.exe
  "C:\Windows\system32\bitsadmin.exe" /reset /allusers
  2⤵
  PID:6840
- C:\Windows\system32\net.exe
  "C:\Windows\system32\net.exe" start bits
  2⤵
  PID:6672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start bits
    3⤵
    PID:6656
- C:\Windows\system32\sfc.exe
  "C:\Windows\system32\sfc.exe" /scanfile=C:\Windows\system32\Qmgr.dll
  2⤵
  PID:7204
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow bits
  2⤵
  - Launches sc.exe
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Windows\system32\bitsadmin.exe
  "C:\Windows\system32\bitsadmin.exe" /reset /allusers
  2⤵
  PID:2952
- C:\Windows\system32\net.exe
  "C:\Windows\system32\net.exe" start bits
  2⤵
  PID:2708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start bits
    3⤵
    PID:6324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38e8855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
bea327e4d29ce86b5779f8f324ed3cdb

SHA1
c32bfd0bdcbdaa10cae45cd2a71f91269dabdef6

SHA256
dc90924b2d1484ac08a6f78d6d711169d3ff105715a8257dcda934968cf9e4a1

SHA512
f61e0765ca6f4e14cae2c782c472abe75da4fc4702c61a45c992ee5a1a967823b1e7d4ece09564da5ed2b53e5b928f820f0f1dd22ae39724122e39b554f0952a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
d6917e6e25791cdcb9de268d4936c375

SHA1
a1ea1cd2228c83dbeec47e10b91ea4ad662e3ed5

SHA256
420a45920ab40654695c29ea8d8afdc70470c98292ceda5a2a616ef66b021394

SHA512
e6e8828846f3d0068dddae68b3159399c30bdb1a366a6390b642b02012dec90186d674d69dcee031726266d3a56584dcb86e9a3f2d1863a2980a480448c4ccec

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\BITSDiagnostic.debugreport.xml

Filesize
7KB

MD5
071fcfdea72a8366d4546fa91579418d

SHA1
41f19698ac45bba499bb35d107822573a9ced85b

SHA256
3330eb81eeaf03006b1564983e4839d714b1dffe95e2167df8fbb5835a9ae259

SHA512
0e4fd57f2dbe1f34d9d360790de7058b6a246b648eff007cf441bc9f956c9108b91ed0517ccb6ae53bcca0f6f138333dd51468fe2da25c6821dbfa61f00cb976

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\NetworkDiagnostics.debugreport.xml

Filesize
1KB

MD5
5796bc11e44377c6b154fdaa0135f322

SHA1
029e91e31230685109546ebc90291deaedf3d30c

SHA256
8e3c7bac1651fbbf5d98738afb5c3a7c6961305e83396a6e7649a833a723ab60

SHA512
f454d5bcf26353a42bb3fa0471330d8a7b8d9a69bfac7e0de2e23e341de088eb8a2795962acbee8c8a5e25e4ac9857acf649d547684bfa5dc08b26711b54462b

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\ResultReport.xml

Filesize
6KB

MD5
8b95a81fdd2a7dc472cab0c4fa0b6657

SHA1
cb6b24e1d1ec692ab6663405a1fea49ffdbbee4c

SHA256
dad01918b964940ba571e54e5185200bf08fec4598a195d18022fdceea04349b

SHA512
a18663652e2cf5e03c3cf45b3b627ab43771c21ec05dff8d97a1268db573997e3b384be726ea45e61c2e8ed4df07c7b6bb6b118548847050500cb4eb9fd615d3

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\ResultReport.xml

Filesize
3KB

MD5
49f092fb64fffa804fdc78a611ff5745

SHA1
eed75ff724df9fdf5df3e9fecaa9e24ed55248d1

SHA256
a402d356772b865e069c8514d00f629093f7faf017d56a37ec9958789240ec56

SHA512
bff61d1f2174edced7fd7fc0956b6b69f312f302aeba773ca8a98a16e1503e8b0cfc9f704a41de91874540d1e1ca39018f89f3e2bbf74fe9fba4007ee4f0d85d

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\ResultReport.xml

Filesize
36KB

MD5
3ac8b38f27fbb97f42fde6273c90ae3e

SHA1
1904bf117f4f37a60c70aa13e339716a49fade2e

SHA256
7d424991e574191a2b65d8ecf456776cd40a009488fbd944f43040ae26970375

SHA512
c982dcec903b850940127c8174092878b5ceb8f35c57211b12c51393c119b5173f4973e878a8a9f645bb13d87ce0bf72b43e40d8a1c54d7357312ad27c7d3c2c

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\WindowsUpdateDiagnostic.debugreport.xml

Filesize
16KB

MD5
1d79805d8049f21b8cfa3c92b617cd16

SHA1
11711963bae72c88863cb6805678ec1137ec0336

SHA256
c554bb36d00894dd3a9e90737db0c0064aa80ea8ee495c42ff8a0608ac4039f4

SHA512
7ed58f64053e0f58f6b4fcdac5256c4ffeb01445a181b96199500230b34576505fdd78e520f534c284f60e7c20fe529580db7a5c123fa19af420948494292eec

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024090204.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70f387b1-b97f-4fa9-8954-b9ce2754a923.tmp

Filesize
6KB

MD5
d957358640606069198ef771dd32340f

SHA1
3a68cd589aeb306c866ed99bd5fbcdaaff34409e

SHA256
18e19cad64b001aa45f657e97574efe026c41171cd83ea0b51d906eb75deb6a7

SHA512
176d4a3a94fc1457a07c8ec5e79fbbdd50b4cec940158b62c41636e71d23cd30f8e186dec75c6774a63f34c22cb95e22c0f63be067a6b9869e9dc8597d1233d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
51KB

MD5
a60948d2ba41189b833866a05f0162b3

SHA1
a612617a89ceb61567f6d5629f15efe896777244

SHA256
faa267fef5e60abfbb7c14b12b9e140a986f34f05159ae405e9e0ba61b84d8e0

SHA512
8c43ec523682aca9b34cfda2eaa247f9a1e0c5f2428c993653be9aeab61ff4e208fa376a49f9e48752e646e126ae1f139723cedb5f9b34c223d565efa374afd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
72KB

MD5
e650accd3014137f623c75730213ffcc

SHA1
5fe10a19b0d61c17eac0946372ea2443cd6bd839

SHA256
d1c928ccf30f60254d161a52650ad157e9573ba0edee1c604250b1370a87a511

SHA512
524e1df944885d9fe2cfdc7686c4ff74a078bba006e3affa88299ceb46b6d7e45a3661d39a14630dc33882fffec16fe4bb68d0042f266319f2f014f3bdd48e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
99KB

MD5
a40932e03442da95ab793dff92679637

SHA1
e9ee8f0e0f2cb5148c47715d6c6879a3e96d190a

SHA256
c75ac4200073e1186dc1ae7cf4c6bfd722c00f75d648af2df712634f49da6362

SHA512
6092ab16d25c3c2f85ed390c15a9d7fc59346cc57cbcafa424473bebb12380075deeabd65b21be61d24dd699f26fd67c860e13b7df25ce0312d7a02beea00f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
18KB

MD5
be09cc782fbab1c0d55dc6329fd0fdca

SHA1
640d9c639cbe1efc77ef91449dca92889396ff8c

SHA256
123d6df0d977487378daac3e336f31076e295d17473a573c3ae389a0bacbdf4e

SHA512
23348f79e3f83618f72186e5c5f98f7ab68bf5ed37daf6f87d44cc9e0685902bc439458e1e1a6faa49aa9962f625176e93da42ed138b91cd93a8b4fd872ac888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
218KB

MD5
85f08a087991b1ceb6ce45fa53179329

SHA1
2fb9e4794f3640d787a140d615e325fa185be2e5

SHA256
861765d7b08037a7284d10c37c9086b0f41b9cef08feeca8b222dc41e9511fe7

SHA512
d44b2c8644549de868fd6ca0febb3cc9199c8b156df127377fbb67cb5c9b398ca32f967a0272e8fa90d40c7cc1e119613725ba4469446990a218ae5e1f48427a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
43KB

MD5
96f323b08598af028679d0b409071cba

SHA1
2bbecf9db63c99fdab4cd60b5419c8cd08b67b5b

SHA256
082ebc11accc56362af86b2f72be65e350a2a34dc8826c35a2ce3128974287e7

SHA512
0f69caa637169405dd56a355df717d8a238f9bde2a914ccc9178ab470a0aefa547796afcac499fd1f0dbf6f91bcfe3ce0dc908ee55abe08ccb3c1f4669559586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
20KB

MD5
98a3c9faab6089f69ebab6fa26f8ec97

SHA1
c72dc16f5c523f1ecbe25626b758804c307492e3

SHA256
5c771a839e91fb87373f83b70ac4f68d12da2b58c6193b3012dcdc3c2521fa35

SHA512
c7372ee85e2e1743f2f31eea0c283b9a5617212eda35101d0ca94016a57dcc97a028fc603bd355f4607f46359a5b18e43d326b90a3853aac3347e143bbcfb67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
30KB

MD5
6fb26b39d8dcf2f09ef8aebb8a5ffe23

SHA1
578cac24c947a6d24bc05a6aa305756dd70e9ac3

SHA256
774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059

SHA512
c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
63KB

MD5
a2b03561cabc0d346e9a6be3f5b11b5e

SHA1
ba0aea2acc1c20700c4c09c5b2b8d0bfbd33ce6b

SHA256
09588f4db755d8d88d9e521f5189d97c2ac781ee7ad782bb0c644eb9f69feef1

SHA512
3602c58bf569bbf22d2a559f0a62c4ac8d6c9868dd956cf0d75d694d104eaf2f82d22c9427636a46ec82cc24e758ad1eaad75fab771ce843308c1b2fe57c6ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14f7c6ffbc2fa7a0_0

Filesize
54KB

MD5
9cbb8a795caf4d558eaaaf7eb6071e2a

SHA1
afa732d34ef2aeb03d10a2526b5caf7b1a94faff

SHA256
6a847b7696c0894e948dd5aa64bd559c1c23c94926ea4a86e268753e216a729f

SHA512
d36b4fa94fe7ef1b6ec1d2995a0eb8f964b0e657915f7fdd44bfd11866c5ea8c88bf794c8dd15fe41682cbbbab8c56c580ae6007a89785aae9c9b6e897e9eea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e9da5a67b8336b4_0

Filesize
23KB

MD5
0d9930551e94db97c3489a4716ae63e0

SHA1
ee7e3d27cd6cc4116b10ab012f28ce61e023cd12

SHA256
b97520ebda8519b43249236388549c94f16552d5c4467e3eec6a9606809cb268

SHA512
5db09c1cfcc481a1ac3f2d1ccc413d413003b66752792029f5a16be57194e3ef17c77a8c0460658600d8071596fe469b99dbc9adaf0d06fd5f39a10a6e2b790c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3512afd3f1fe492a_0

Filesize
14KB

MD5
49de3e3dfc8d368127ae53a155da3cbe

SHA1
7a3777ed5e1451f10e189077a96f524990d51fed

SHA256
d8f554189d7c24038296d63a2bf2121f49bae5fd2e858e32f24e98a692782781

SHA512
07652564bd9d2d06a0cab75d10953d7050e0ab73a1c3b69c26be4c3ed420659f1a3b6cb7be3778f1d71a2c417ac7a51b69213c2af7a22b5f19f81dddfb076c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5aa96bcdcd57cc58_0

Filesize
267B

MD5
d97727aa0bfdbfec208ae7b46661b147

SHA1
5f1b59c53c965a12bbe09e78dbde559b18960f88

SHA256
1a29b250c412e749a21158a4807883a1d91026d0030fac16bda54877278590ab

SHA512
1ab9fc3a8d15d97dec014ab4b96c43390076c122bf081e251b9f380e45ca719432ded634fa6fd0007815f5d33a419ecca8f9b1883478b18ebc7e3c5b24349202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\901f6361d57ddc36_0

Filesize
342KB

MD5
2f770d8866c44bc7fb471dbfe7cf9e38

SHA1
3ed8214caa97b3482f0c3c973784d748b64ae2d5

SHA256
f1859105ca1e3f1135a83b50540855acdee17ebb048cd35143c7aedd19ae09dd

SHA512
b341a4da393c9bca64ab294da53e9db2d249cff1f6ea2ff45d5976d68c277e5ea72a8d1859aee3fc0b6eab56ccf86fb73ac16b81cd8aea089540fa753ecb5555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f3e7d5f57f5e7d76_0

Filesize
158KB

MD5
03dca0dd8bcef4d69c9a90a5fe98a430

SHA1
59c3615815b65c1e69ddcb6aea75903a8fe5824f

SHA256
de51dc68c722bf4f3f02d1669fcd1a08c0ad3866895b4a4a5026fd6fbb131521

SHA512
76c11d41af8dc5151216ed8188f62e902ddb576693311bb29600340808f4dfa9ce4e6d4c82afaa7ff3dba7035b1cbb0f5a6e4d25059ff76e06cbd6e56fda0539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe2c84cb57b84a87_0

Filesize
277B

MD5
a76821ddbd3250a03df44c042fba109c

SHA1
e0e41ea0fd6e4557d9515980ef3ace9d4d2b8df8

SHA256
d214c53f592f62f5ffe30d713b986cc3daea97cc989d7dfe4c0e3b1558d40be7

SHA512
1fee3fd3b14a5d13fe879569e768adb376e8d39082297fe22902174daf3fd5f978b33cc8dda05050ab68cd0e7533c3ab3e5970222c67013bf5f2c3d83db9d50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
689cb98021ef463a480923115d4e7fd4

SHA1
aefb886829f662986943ebb3100d38a7b0a34cc8

SHA256
7938293a7b95400a8c60fd7713b4b2d3d0539b8b6ef97f013a46b48b832242c1

SHA512
51f28c3dc0fef966510616f9cfc253442d643412f21f35b32e4da1dea2b92b5e5e6cc2f0b4858ede0f7acfd9855cf0b6f269448ac6c00835f378ac1be9c91a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ca286f3acc8f481d68b6b4f8333ffdcb

SHA1
1ee3a89f06a2564f49e0ffdc89a2e31d8a46e832

SHA256
fcc3a50a9d979fc8512e094b8069309add14980a3513c6b8f39033820ada8393

SHA512
6b2d9531f6420caf64c49226dfdf432f60c286520f283a263402db5f29ef7ef74873a776440d3f9f0ff3d109bd8778b1fd0b885c29303ba148d8d546b14489d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6e47ba2b734dc44956b314a75b494e24

SHA1
c757c723521f0a4552a3f779d7a4332b3a25319c

SHA256
e30fa5a7614cb4a3ffe9e2d919468d71934cc1c0e0cf85151d02bae6a321163e

SHA512
ed597a96762d12bc98ba27de91c28695579bcb008e26e24dfccb3462801016c998cb66b39605bf658e276da92df354c9e0e58981ac3df74115ee51eefb8e05da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a8875460e2af2f11cb0fd97e62c78a9f

SHA1
0c586ef7b0c506a4163708d2ef36d5a8179ee9b9

SHA256
eb37d0c9ed602c45da04c71576e76094f72c917ed349b4be483a60fc65d83acd

SHA512
9408fcc192a356351495253af0747f3d5dd69a7b549bcd7150bc91407e25347663cea5eeeff8ee58b938fd572a6d2610fe7014ac48ba476d71c3696462be82dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a62d292a5811f84f303be48c5b240a29

SHA1
e2dfe22a7444883964408e69acc962bf104599e2

SHA256
a581a2d35bd6aa2422d70ccc3e22ca1aadffbb231800da9102fb1bec20898a1e

SHA512
2ac33641ac5633bcf1ed20deb69845c5a9896c06a08fa1c15ff6a21417d9dadfc83df16deee01ad5a866bb95b85b43ac22abe3ea674aa8b1096abc7989356094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
e1125c2875bc92842212c04658e0023e

SHA1
45688fbe22d9dd28f1735e129b072935bb2c870b

SHA256
d88934a98860f3249067f604099c456db5eefdf376342af321f1ef4cd1c86207

SHA512
56d590b06550ae445a74dafe4b1fdee19670ee7faa493d327e2b933fbf7d180ba55e951a49138c54412403da6ee6ace3674cdec2a10fd7fb9ce4f1a977f4979f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
26adadd64a7d477858f074f92864e5e5

SHA1
122afd7d1f0fea303b395f7cc166d08bbc0fb2ad

SHA256
afea9fc45e327e1592920e2a8b8e4e12d3c38768c7f370529f87f08d8809e3fb

SHA512
999a5bc349c2082576b2a98343b58273e5be0bb6d455e5877e10cfed5ab5df2f3473ab4c28850e10b2ef7afe8c47b431788cccea2ba403e55aba52615b532247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
fe3dd43bd3eaff5eadca97e6785416ce

SHA1
82505ef1c34194cb5b8043fe95a496cfcf31b51a

SHA256
d7779747b1e154e9e62938eec8fff3d854cd243e3106608d1f4b140f02b50696

SHA512
293f1bb13e8e38dadc76a110759dccae0977e87245a98bb1f6ba248eae20fd9ad050b2747ea647049d76c6de9b63a33a639eb329a18efb9c85be0afc63e08c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1a9fc2ac84a3195069070b0bdb27ebe

SHA1
cc6dfa66c28c57943bd9d06db11685186e3e8a1a

SHA256
1a8bbfe262e5d9ed6c98c9712b2086ec8e64d522df021ebb1913922221f94143

SHA512
aae247bc84bea2d2fe9f66ff5f4805351bbbafc3261ceb83dfdcad1ea72eaa3d3b4886b9c4380082b1db44428e1bc3490eff271a1619f2dbb9d9339405ae7869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
f2bfa069a241327497aea4361571906a

SHA1
f60f8399d3f93eedc191c95f09e113adc1954cc1

SHA256
7f60691e04ede8c8e717aacb63033f80e0601686863927c40d150de6ca6beba7

SHA512
21a9023951387590339dd162a1f91f1145b49314e96853ae885b4388906321b3e153b518a16b842f8d7bfe0ca5bd22253851e344036d7486af71695a77103725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
ffe4ce30337329d6eaedac52b6b5e13a

SHA1
28e4e0d605e4a2b2016f8a95dc9dd5bda483060b

SHA256
3c03e82a5a87a53c1b44d19ba2f81848593d507606d0b9b60ddbbff59dfdb2d9

SHA512
9f2094aab578c1e588b34eed57ca2166836f38cf3ff529f4347f004fc8b4aaed780381baa8546bbd83e7d386cd763185daed60c5734a2a1508f679253fcca468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
6fd5ddc9c9c403e92eae6765df21bcd4

SHA1
1d2fa036bd0fa0bc454737c204b8d7140c256cb6

SHA256
9409bb92623d9343d784aaf7a3eb98987e6e7ecda1b196064a30df20ee9dc8e3

SHA512
304b32ccb7a7bf994e4e98b3d70b8bcfca51778b09f9d6028dea62355e17038a3b806ea34230c1c3dde5be57827eb8cfdf93b94b6cb862e64284b398b4e52766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
001167510bbed27140aa63822287e8c8

SHA1
4e8197f96f38439909f2e30f8593e6b548d44705

SHA256
e2037e76f7aa67089b97e09f0abf458ce03dbe957ce4f08ee503b5f145244678

SHA512
7ae81fed1b332c38d78e9355aaa6e375a69f966754d0d874226f2733f10d989a34fea3050170d70f56fc30898ee55e30f41b91038d12aeb49c49b3b8b16baf75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8457ae00a803b8828b3184ecd224c0ec

SHA1
d010a70b265bb2bdd0afdfc7ad5e2d76d187e6a0

SHA256
49ab354b37bd2931cc1bea1efe1841adf904337b0192c4cdcb3380858e224f10

SHA512
fcaca4c92012a9d238ee7cd48c76d63b6e066f7c5f3beeb1619bf59d410ede90f8d6c2a28d9709214149ebd77914f548eff568385c78d6820599cd288a562543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e9abbbf46cddffcf09afbccbe909b83

SHA1
c2ae652ee9e7c8426999fc9308a29e82fc7a8cfc

SHA256
3fe6c67afcce929316163f0f8c4874352c4109884ba9a55b29ce825d52ebeb6f

SHA512
0d1172296a3664473451ceb41c3fc4421ffebcda0d6d96177cbd7875d584d5ebafc28809eebdfe2d17570b4b5bb44b9c252ae11a16943a838c6b5f0a3c356a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
99d72805d2eedf60ceb60f133505b706

SHA1
79628f6c4ebd4010617b83b841072e5fbfc67ae4

SHA256
a5e05bef78095b2d7dd440bb5e9f6cffc4d03801a377e2df394bb5b837c67bcc

SHA512
1514687c67db143ea67fdb0a3a885470c3bd669e3059c823c2f5665568eb4f74fa4a82ff8df6d935d14181d7d1ddc2c9555cc27acfffb826c2791bc10359718d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
8024b31418f26131ff17200ab09e1947

SHA1
f045e53751fece08a9fc1eb667de8a97c933820f

SHA256
bbaa819fa55c35f32bdeb9f6ea6866764ac69605f6391532066e1048e2eb8a19

SHA512
bb90df887dfcfa12cc840248f9d9a6030ec927ee48d683070e1ed85236d4572070494be606f64d847b06f7d299175fc9f1b69fe1139873cbf8ede12d9623af18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
ba371aed762b80bc58355250f53106f0

SHA1
e1b237a0363473ed99310ff919425824d9cf0046

SHA256
505c3fbc419d3d13d8693d1cd8cf29d91e53912ea14eeccba4d8a1b1a91a1b38

SHA512
b5f0cea223c225adc8342902cdf591162fb8eff68f9b34ef3b4db8c18cf819d5263cecbc8dc777dc189a8f50663224ecf29bd3254fa278fb46155dabf58f6378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
aa35d6b391cd03c54f9c0d854b0db419

SHA1
3a16014976e396f187c7ff732b21018b7fe21238

SHA256
1fabd905bb5f265c41836a3d2bc793a978e92f8e41cbaaf4363db41259a7fab3

SHA512
9bdf4eef1b4945405922677f8325f09f331b3c83e85f91395c329a4217a72f869117c9a7515c3173b87774b0fdc2f0d27922fd847e45bb22b0b57177b7f3c777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
f1b79230bb935f175283412a77ee2c4d

SHA1
ec566d8862a34e2410694bf6deda672fcfa3a220

SHA256
46cdda24ec842b60eea2abc819344ae582c04cf9102abeff4f2f2c473034cacc

SHA512
66d2f15a8c1f50c2d7aca9df36307a1db87f4dad22f56569835ddf2f6cbe5e2b50d9efe57a970b667a1795b9485f5a0afe728fa929af9b6d5370d9032b855489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
e4dc3556851688d2a9bd241793e8b941

SHA1
c89eea0d0ef5597b625edb0ff43ea1f3a6bdf8c6

SHA256
aab17c69442b084c284dfd6f2d9fe6eecb86ff540ee09668d4b67b14f731ab2b

SHA512
72c6ed70f41ab3828ab78ca9b6ca6190c66393ca4d75e557306210dec7b4bab86a2a1715ced08ec65525865d3c645578ed87a126018b41f43240893ce2ee3299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7847bf9078283ef3ab69a141b8acfe58

SHA1
625081450aad382130b5293328a36824638dd573

SHA256
ade2c914175ef43ad685ff23229815b37a54ef7883cbbd60e0a705e702d77e2f

SHA512
f1f8ae9f7083f85cb403a75476862b600feccfb9b3a29afbe9e2c411d3327a34fe96f75e9213037e8dd522c5a509e60e15c439c2c5a83ce5d767a034f4b2fbfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
0e0008477afdd6e11a88637734e98427

SHA1
03d13d5b15de67e7dc324d66bfae2271f9b6dda4

SHA256
92711043ca1e09fbb753f8ecee53705c5eff74e858384e6ce6756cd071c117b9

SHA512
7b21b3a96845639393baba216a32885463a0dc52ccaccda03d15ce2f33e70c9610585e5523eecc8de6f29bf18e6bfdc51a26bf5c31712373c85a33f5afd1740c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
b8bcd293554dcab360cb24598edc7748

SHA1
6fe68e4d9fbf8b8e54295dae95c64811d1f33f86

SHA256
064a6826cc00ca53e849ccfcad50d3c566a94625022d0db98521021bf20cc494

SHA512
755a750ad923e7a906ec569153f5850f305eea5bd3bd094f4a56fe3b32ee7a5b1900ab3976c6c89db82868a7a49010d6d66d39c120f5ebcc401ca9e713dc4d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f81d05dd9ac0bdb0fcd1245347807964

SHA1
495177dbe2bb04998094594949e9e444c5e9a6ea

SHA256
338f138421e4348bc9a7cf8014d39f2d725fea1e2946badf276692fe47d1fa90

SHA512
8b21ea82bfbddd8a6531a60994946e35788cc72e264a8c04e381dfba95817fce9431d8527ad93254f37e2aee9fb996c599811c6fcfcd3b146399c923117aadd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e5edfcd591eba341d1c5b17f8af6a30f

SHA1
369e447ee3fe25b7b0c0a6afbfd0f27c321666ef

SHA256
3c6b980d4f3b60d0e77b8f721bdf94c0bf56c0aa960f20fcc89a33bb933f9000

SHA512
fc18a1a267e5d93d759415186aab8e213cdd8e61538d72477eb758a51747737f7b6e2ce013e3caca6e78833a89149e940f6ab5d34e918f01d59f6f19e86ecec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aae7fb2b9d0a2bb7271ca568647c0961

SHA1
f3f8fd1fb2443f64b85a9e54877576fbef9315fc

SHA256
51dc9c89dc79ef7fdf6cb32c4999f961fc7bc89391fcd7d5634a39a45831c94c

SHA512
7f43d90f6b55bfcbfae3f3fb334139ecf78e424d38466f3d2620420b9b28fd49770265535c85f6541d4b9424c5364b863443890d9552d1343216a2530b238cd9

Download Submit
C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt

Filesize
36B

MD5
4f60eee67de1653e7f15db0e2e233ca9

SHA1
8b18d0832532205ce21188a2803d498b6b9389ee

SHA256
e338b859ea0237169819c101cd8a9fce2c10f5d76e4d260a8dcbb6f97d85c0cc

SHA512
c2ad98aaad0c033bbe2a2ddd87f5045041920207910e4640548848f81f3f0c63680ec9d83839c2f8fd71819457ef259230a7687f9f240db4fdfbf0c3f30f71bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg

Filesize
11KB

MD5
e8439c4e8015208e2f4282657e423ecd

SHA1
d7c5a264eefde22b2640dd349a4c5bdd49e2bd9c

SHA256
5ea92e4430ae7476d77839bc8af9a62a27882f51594972bf858abedd77ee94f8

SHA512
2b4b87406438c9086030ab1f70f381b002bb82c8b03e7b2c3b519c3eed6a8d650d1c974816c1415c51eee84ce681f312569624bb91bc276bbbcea5b6165d2305

Download Submit
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe

Filesize
557KB

MD5
8a4e72a29c08ae2cd13bc8ec414b8fc6

SHA1
26f8d73bc6f5ace5cec6e3652fc6410a71298498

SHA256
6513546697c3c9deb50d8dbb0cc9aa0be55487538ed482ec16b6264579de1539

SHA512
77eba566c65de1327bcacadb1483f538b4e5da67c3607398d745173ade25e987f59524a5ecf065dd5f95e26654cbb5a48dc80fae995d5d2dd63c63b2cd98fb98

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG408A.tmp

Filesize
9KB

MD5
5246013360a674bf26d315c3cb328be3

SHA1
e09f48f68657f3950c7eee13b53ae57b135b654a

SHA256
91628b4f18c816886fb2aa95dbbd92a27e7d000ba82623dcb67c5e67bd170f89

SHA512
14c1d0d40b2c8ee38483b9edfcd8cfe79cfb5f57c1495418cab1c483d71e69390a387697bc09ce986c0981babe308793b6c8df02182c5311792939b2efc07270

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG4099.tmp

Filesize
270B

MD5
edcaaed49057b04d804ef38622dcfeca

SHA1
200458ae3a380983860136acca9b18d62c5bac76

SHA256
b9532ca922a984f207d3a82499308fa038e1d78169b534b8d7fc116aefe5a05e

SHA512
052065767b3bf96cf1314dd8c42940ace0d256eb7f536de0b642f5816dc0b5e6db3ce9a10450e9564b7c932e9261a9d78ca7929a4537646cbf7d5ee8c363b5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG41A3.tmp

Filesize
598B

MD5
eb0997366753d3e711eb18c99d7f3411

SHA1
c833b71e962ea91fef4ad65e48c25cf8e5615cc6

SHA256
b5a8fed53d103c292a73d095fe47af88e75d9f0f672d232535dc45cb4129cf32

SHA512
4f2c4b10dcd77014b5c76f53e95e4d37a4d5c408551398d067aaa3f910909269e7a27b59869a7103712613a8c8928547c39c2676af7ef5d6da687e31edc07224

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG41D2.tmp

Filesize
397KB

MD5
dc3419bdb4eb9dc43559edde10f3df41

SHA1
0d6713afc36f8adbe811876a58fb6b6f6def1a7c

SHA256
4e400825c4c63e7288775c0f26641f75cd21fa0e332c887f4a0d56ae9e469a4e

SHA512
a9a610bcc505fff13df11aae51e3f5fafc653100bec29943d3203aa67b28b665f67a3f07818c70197fdf52cc6966d3238197a5522fb786c9c2b990e574fd9853

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG423F.tmp

Filesize
4.3MB

MD5
906dac0abb61430a17841933c3e3abd4

SHA1
dcfbf3abe1e8c5d2b16185c061d262f044fcec9b

SHA256
4754c9ce6184c359480860fd429ff47e16b6133b5b16f945084e45d71eb5a162

SHA512
b6f64440795391b201e6fe10379c8854e69ebe2a2d82c35ed337cfc844bc1405b632997755f34d44677f65c4d61715f480dabfd5e6c435c4fac1c6b933c2d215

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG43F5.tmp

Filesize
414KB

MD5
840d406a553cdf7eaa08758cc1333861

SHA1
4bbe5c654594dd5830fba94be2fd1e32f756493d

SHA256
22e1e83ec87bca421baa14e566ba8cfed8f936f0ba9ae45f823c70f861ca98bc

SHA512
88e1de8b868d2b21948157fa10c07b4051fa5f8c2e0dc53e482003effeecf6b77199870c8fd108648ca1d188adbb9533be2adb04423245f557c42ee522d7e592

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG44A0.tmp

Filesize
740B

MD5
5b20f739acefbfc6237c04f216466883

SHA1
738af05cf8a177e14726ae4c4affc6d9b94da6a1

SHA256
f787f543d052d4000d007bdcd71bb6b7024293f2ad2d543b02b4121b1da3ebf8

SHA512
c82cf736af02ffe5e76b88d802e7800787826bbe5cbc59b64b4f77f9ff1168f9ed43a9c68e3a9d13407e38f16822755660d359b42ae339d0d2bac754f192651f

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG45AA.tmp

Filesize
3KB

MD5
f90a03d152e8202c3eb57c6e6eb710a8

SHA1
cab5b11304ebbb9a1ca9c191fbc737082bcb49b9

SHA256
89eb956a0ac5a7ebd558eaaebe485c87c40c47baf1954b272b26b0b8724a6352

SHA512
2e3e8c359ee1b97e5a01aff6192fd39236f14cd75812fb9ec2488e938c52db294c859062d89b84f6593d3c492d310fe6b514df235b52dec189e7b62e02bd86fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG45D9.tmp

Filesize
3KB

MD5
cca36a379e81a944c607e4f4d544c565

SHA1
d09aef7d6cf0bd140f121a85ae2b92307119db89

SHA256
8975303228de2bf10d7a55bfbd591bce14e4a124910265eefbeb58229347268c

SHA512
8a851c8054c694dcf0b942550de764915f0c860277f910fa0fa6d66962f7e6c7a7c8498a0abd55e51e6725fb585820a957c079351883429242e4c0abf7f79158

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG4627.tmp

Filesize
4KB

MD5
9a6b92b10fa585333d0291ac3d87537f

SHA1
9536e72a6f059ff86deaefac6676305fdb23530b

SHA256
713b38ef078f28703e15256cb30ccdf5e496256f9b0e92768d0a63be39c3e825

SHA512
28605010c1a45e8d08e1b4ab82a697694ed977213902707a03f6da0570b37cfdba00002e29ad072273d3353e18200d763e2f05cc504c36fec53778288ad5691a

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG4656.tmp

Filesize
3KB

MD5
79d558a3f5a649a98ac348ed8a0bf6dc

SHA1
5cc1a6a3339b3104af499a8d44fc426d54021e85

SHA256
23237d250e185d524d26dbdc6ce16adffa9a0b65af35fefac3bf0d01004d5bd5

SHA512
6ff24db910fd94551806670d922c31802e4f49dc68e1fc31d33cae1269822c6324563672804f0eb8fccaf2191281d860f74f243b0effcb844ebb3ec8044f85d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG4675.tmp

Filesize
10KB

MD5
b0223e1939178bf83ef084f4d98d27fa

SHA1
5d1b1aaa0e159fb6ab3370c473f38c7910b28663

SHA256
beb092700ad0e8e12c2d46c23b5f56c78fccdf25291f92fbf9f56f205f59f10d

SHA512
707d24203e0adeaa521d62f3e7b4bf4b73f17849294a7f33e8dc89d563c942a7cebc08bbd1d55d9ca3d46be835983e9310386c2339cea930a50ee862f97f01d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqhq0uqc.x2z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\MinecraftInstaller.exe

Filesize
32.3MB

MD5
4f02ac057355b5dc73ea28aecd2d56b4

SHA1
32591cb75779a3e308a44e75a76f821e7dee11e0

SHA256
83a5f942b2a15eab4826ef1709ec6a7f9637a7ec0fce16585776848797307fa4

SHA512
9eb08f85559df6af9192bec8904097d4e43a832ba9e9cc1c7be1a366af8d103c3a6db3886f00927ae5eb62055fbc770c7b5a3d2a122a0b460b51136083015368

Download Submit
C:\Windows\Temp\SDIAG_a5a7fdeb-a770-4165-9601-fa48300c6de8\DiagPackage.dll

Filesize
478KB

MD5
580dc3658fa3fe42c41c99c52a9ce6b0

SHA1
3c4be12c6e3679a6c2267f88363bbd0e6e00cac5

SHA256
5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2

SHA512
68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2

Download Submit
C:\Windows\Temp\SDIAG_a5a7fdeb-a770-4165-9601-fa48300c6de8\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44c4385447d4fa46b407fc47c8a467d0

SHA1
41e4e0e83b74943f5c41648f263b832419c05256

SHA256
8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4

SHA512
191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005

Download Submit
C:\Windows\Temp\SDIAG_be287ade-c00d-479f-bb05-aec86206ec7b\DiagPackage.dll

Filesize
77KB

MD5
fc7504df42668c2918657d1b9a3102c9

SHA1
5f9a70a31678e2e8b9a10849ea8657702d0cb53d

SHA256
159c4d4621f4ce1f4da14246401d85a00b40c0090fd0b2640446a896127ac646

SHA512
c844f9e5ba72eddc6aca73e09214bf8372ee5676124077983b78b10b9830a5e5eabd9c9fff2650858836f995ea79b1f0502609a428797b838ac7cda3f627c0da

Download Submit
C:\Windows\Temp\SDIAG_be287ade-c00d-479f-bb05-aec86206ec7b\en-US\DiagPackage.dll.mui

Filesize
4KB

MD5
2ad9d1abe41ad048186f196b58fd8e9a

SHA1
d9c66f6ef89ad126ef2bbb36e0bcf6fc8a0e34af

SHA256
9b9acb69e01f79160d368cdcd8a4dc81f18da6398f920b6f663938171f5f718c

SHA512
4c4e1e5bbe173dfd37c65fff64a029883b2f719a360a9f5ee0772b304a518839605528b97b1ac0319b79a6d7f284767ad6c04b3b769559e2b14600c467947d61

Download Submit
C:\Windows\Temp\SDIAG_fc555f8e-5833-4028-8b78-5247ab8db7ac\DiagPackage.dll

Filesize
77KB

MD5
458bc0d439cb0d955120ae319c6ed91b

SHA1
b8899daffcbf912462d7e089d126d664c1a40216

SHA256
9454ec899ff78ff14c4c5137ba23d99dfaba079c629afd790640d0f07724201c

SHA512
fda4a2641db70fabc10d73dc28dc13f3b85140a382e032fa7a46abd5eb72e076f96794ccbc0f344a0cc88222fe27ee527a3587eed286e3e3db338824950369c0

Download Submit
C:\Windows\Temp\SDIAG_fc555f8e-5833-4028-8b78-5247ab8db7ac\en-US\DiagPackage.dll.mui

Filesize
6KB

MD5
84d58b706a4a16e582a140f72110b7f5

SHA1
bb7a3f254dde61f948417eabdc5a0883d102d873

SHA256
4b012aeaa40324691c6af926d5bb27409232fe8c484fd295d64925fc36f31060

SHA512
9f520c9d00586d9fb8a87b904d75616ca18b6dc3badd1db71ee85236a6bba459d56eee6ba29ae8cd2139fda8e5df961b232ad87a17fb4dbe61dd4422d804c508

Download Submit
memory/2904-2-0x000001BF80000000-0x000001BF80270000-memory.dmp

Filesize
2.4MB

Download
memory/2904-12-0x000001BF80000000-0x000001BF80270000-memory.dmp

Filesize
2.4MB

Download
memory/2904-11-0x000001BFF6440000-0x000001BFF6441000-memory.dmp

Filesize
4KB

Download
memory/6568-1581-0x000001B97FD20000-0x000001B97FD42000-memory.dmp

Filesize
136KB

Download
memory/6780-1056-0x0000000000810000-0x0000000002866000-memory.dmp

Filesize
32.3MB

Download
memory/6780-1057-0x0000000007620000-0x00000000077E2000-memory.dmp

Filesize
1.8MB

Download
memory/6780-1059-0x0000000008350000-0x0000000008358000-memory.dmp

Filesize
32KB

Download
memory/6780-1061-0x000000000AF80000-0x000000000AF88000-memory.dmp

Filesize
32KB

Download
memory/6780-1062-0x000000000B680000-0x000000000B6B8000-memory.dmp

Filesize
224KB

Download
memory/6780-1063-0x000000000B040000-0x000000000B04E000-memory.dmp

Filesize
56KB

Download
memory/6780-1074-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

Filesize
40KB

Download
memory/6780-1075-0x000000000B5E0000-0x000000000B606000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads