Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

MfYecZ9i.exe

windows7-x64

9

MfYecZ9i.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 23:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MfYecZ9i.exe

  • Size

    27.9MB

  • MD5

    34e055a67b10a1a14994b6b3457698e2

  • SHA1

    6b299dca56f55a0656b23fd035f4353dc049343a

  • SHA256

    01b6ee7d4a8b358ef51e4f2d19f75ff4de4d4acab7c56f2a3063e4b35847dd09

  • SHA512

    8437dde18940cf8197d25f729bbaaf0803b81ffa1ed13128c91e6e3a65f01fc8253a19badc6e71c187928832dbabb03cf45ddc392e19e4c5dc6f741ada13d218

  • SSDEEP

    786432:PPhOXo+/5eJC7HRCyM1yMRUEvTHBfBRcda3:3AY+/4JOlQ7PRco3

Score
10/10
dharmabootkitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerthemidatrojan

Malware Config

Signatures

  • Deletes NTFS Change Journal 2 TTPs 60 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (509) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Boot or Logon Autostart Execution: Time Providers 1 TTPs 32 IoCs

    The Windows Time service (W32Time) enables time synchronization across and within domains.

    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 60 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 25 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 5 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 11 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\MfYecZ9i.exe
    "C:\Users\Admin\AppData\Local\Temp\MfYecZ9i.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command Remove-Item 'C:\Users\Admin\AppData\Local\Temp\MfYecZ9i.exe.bak' -force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1600
    • C:\Windows\SYSTEM32\net.exe
      net stop w32time
      2⤵
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop w32time
        3⤵
        • System Time Discovery
        PID:4112
    • C:\Windows\SYSTEM32\w32tm.exe
      w32tm /unregister
      2⤵
        PID:1656
      • C:\Windows\SYSTEM32\w32tm.exe
        w32tm /register
        2⤵
        • Server Software Component: Terminal Services DLL
        • Boot or Logon Autostart Execution: Time Providers
        PID:2668
      • C:\Windows\SYSTEM32\net.exe
        net start w32time
        2⤵
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start w32time
          3⤵
          • System Time Discovery
          PID:4920
      • C:\Windows\SYSTEM32\fsutil.exe
        fsutil behavior set disablelastaccess 1
        2⤵
          PID:4196
        • C:\Windows\SYSTEM32\w32tm.exe
          w32tm /resync /force
          2⤵
            PID:3600
          • C:\Windows\SYSTEM32\sc.exe
            sc stop "PcaSvc"
            2⤵
            • Launches sc.exe
            PID:2608
          • C:\Windows\SYSTEM32\sc.exe
            sc config "PcaSvc" start=disabled
            2⤵
            • Launches sc.exe
            PID:892
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Drops file in Windows directory
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1344
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get VirtualizationFirmwareEnabled
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4880
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "$env:firmware_type"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "confirm-securebootuefi"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4140
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "Get-WmiObject -Namespace 'Root\CIMv2\Security\MicrosoftTpm' -Class Win32_Tpm"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3256
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4392
          • C:\Windows\SYSTEM32\net.exe
            net stop w32time
            2⤵
            • System Time Discovery
            • Suspicious use of WriteProcessMemory
            PID:1932
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop w32time
              3⤵
              • System Time Discovery
              PID:4192
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4800
          • C:\Windows\SYSTEM32\fsutil.exe
            fsutil usn deletejournal /d C:
            2⤵
            • Deletes NTFS Change Journal
            PID:4724
          • C:\Windows\SYSTEM32\fsutil.exe
            fsutil usn deletejournal /d D:
            2⤵
            • Deletes NTFS Change Journal
            • Enumerates connected drives
            PID:424
          • C:\Windows\SYSTEM32\fsutil.exe
            fsutil usn deletejournal /d F:
            2⤵
            • Deletes NTFS Change Journal
            • Enumerates connected drives
            PID:3112
          • C:\Windows\SYSTEM32\sc.exe
            sc stop "SysMain"
            2⤵
              PID:1104
            • C:\Windows\SYSTEM32\sc.exe
              sc config "SysMain" start=disabled
              2⤵
              • Launches sc.exe
              PID:1612
            • C:\Windows\SYSTEM32\sc.exe
              sc stop "SuperFetch"
              2⤵
              • Launches sc.exe
              PID:3780
            • C:\Windows\SYSTEM32\sc.exe
              sc config "SuperFetch" start=disabled
              2⤵
              • Launches sc.exe
              PID:436
            • C:\Windows\SYSTEM32\fsutil.exe
              fsutil behavior set disablelastaccess 1
              2⤵
                PID:1620
              • C:\Windows\SYSTEM32\sc.exe
                sc stop "PcaSvc"
                2⤵
                • Launches sc.exe
                PID:4576
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reagentc /enable
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3128
                • C:\Windows\system32\ReAgentc.exe
                  reagentc /enable
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4704
              • C:\Windows\SYSTEM32\sc.exe
                sc config "PcaSvc" start=disabled
                2⤵
                  PID:1148
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                  2⤵
                  • Hide Artifacts: Ignore Process Interrupts
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2096
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c mbr2gpt /convert /allowFullOS
                  2⤵
                    PID:1580
                    • C:\Windows\system32\MBR2GPT.EXE
                      mbr2gpt /convert /allowFullOS
                      3⤵
                      • Enumerates connected drives
                      • Writes to the Master Boot Record (MBR)
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4100
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                    2⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4844
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                    2⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4772
                  • C:\Windows\SYSTEM32\fsutil.exe
                    fsutil usn deletejournal /d C:
                    2⤵
                    • Deletes NTFS Change Journal
                    PID:3288
                  • C:\Windows\SYSTEM32\fsutil.exe
                    fsutil usn deletejournal /d D:
                    2⤵
                    • Deletes NTFS Change Journal
                    • Enumerates connected drives
                    PID:4800
                  • C:\Windows\SYSTEM32\fsutil.exe
                    fsutil usn deletejournal /d F:
                    2⤵
                    • Deletes NTFS Change Journal
                    • Enumerates connected drives
                    PID:2264
                  • C:\Windows\SYSTEM32\sc.exe
                    sc stop "SysMain"
                    2⤵
                    • Launches sc.exe
                    PID:3904
                  • C:\Windows\SYSTEM32\sc.exe
                    sc config "SysMain" start=disabled
                    2⤵
                    • Launches sc.exe
                    PID:1548
                  • C:\Windows\SYSTEM32\sc.exe
                    sc stop "SuperFetch"
                    2⤵
                    • Launches sc.exe
                    PID:4544
                  • C:\Windows\SYSTEM32\sc.exe
                    sc config "SuperFetch" start=disabled
                    2⤵
                      PID:3988
                    • C:\Windows\SYSTEM32\fsutil.exe
                      fsutil behavior set disablelastaccess 1
                      2⤵
                        PID:2148
                      • C:\Windows\SYSTEM32\sc.exe
                        sc stop "PcaSvc"
                        2⤵
                          PID:2396
                        • C:\Windows\SYSTEM32\sc.exe
                          sc config "PcaSvc" start=disabled
                          2⤵
                            PID:1788
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                            2⤵
                            • Hide Artifacts: Ignore Process Interrupts
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4472
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                            2⤵
                            • Hide Artifacts: Ignore Process Interrupts
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4868
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                            2⤵
                            • Hide Artifacts: Ignore Process Interrupts
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3916
                          • C:\Windows\SYSTEM32\fsutil.exe
                            fsutil usn deletejournal /d C:
                            2⤵
                            • Deletes NTFS Change Journal
                            PID:3012
                          • C:\Windows\SYSTEM32\fsutil.exe
                            fsutil usn deletejournal /d D:
                            2⤵
                            • Deletes NTFS Change Journal
                            • Enumerates connected drives
                            PID:4028
                          • C:\Windows\SYSTEM32\fsutil.exe
                            fsutil usn deletejournal /d F:
                            2⤵
                            • Deletes NTFS Change Journal
                            • Enumerates connected drives
                            PID:3736
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c pause
                            2⤵
                              PID:3488
                            • C:\Windows\SYSTEM32\sc.exe
                              sc stop "SysMain"
                              2⤵
                              • Launches sc.exe
                              PID:2484
                            • C:\Windows\SYSTEM32\sc.exe
                              sc config "SysMain" start=disabled
                              2⤵
                              • Launches sc.exe
                              PID:2504
                            • C:\Windows\SYSTEM32\sc.exe
                              sc stop "SuperFetch"
                              2⤵
                              • Launches sc.exe
                              PID:3944
                            • C:\Windows\SYSTEM32\sc.exe
                              sc config "SuperFetch" start=disabled
                              2⤵
                              • Launches sc.exe
                              PID:2000
                            • C:\Windows\SYSTEM32\fsutil.exe
                              fsutil behavior set disablelastaccess 1
                              2⤵
                                PID:2440
                              • C:\Windows\SYSTEM32\sc.exe
                                sc stop "PcaSvc"
                                2⤵
                                  PID:404
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc config "PcaSvc" start=disabled
                                  2⤵
                                  • Launches sc.exe
                                  PID:4212
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                  2⤵
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4236
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                  2⤵
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5084
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                  2⤵
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2356
                                • C:\Windows\SYSTEM32\fsutil.exe
                                  fsutil usn deletejournal /d C:
                                  2⤵
                                  • Deletes NTFS Change Journal
                                  PID:4696
                                • C:\Windows\SYSTEM32\fsutil.exe
                                  fsutil usn deletejournal /d D:
                                  2⤵
                                  • Deletes NTFS Change Journal
                                  • Enumerates connected drives
                                  PID:5064
                                • C:\Windows\SYSTEM32\fsutil.exe
                                  fsutil usn deletejournal /d F:
                                  2⤵
                                  • Deletes NTFS Change Journal
                                  • Enumerates connected drives
                                  PID:3544
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc stop "SysMain"
                                  2⤵
                                  • Launches sc.exe
                                  PID:2144
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc config "SysMain" start=disabled
                                  2⤵
                                    PID:1336
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc stop "SuperFetch"
                                    2⤵
                                    • Launches sc.exe
                                    PID:444
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc config "SuperFetch" start=disabled
                                    2⤵
                                    • Launches sc.exe
                                    PID:2688
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.diskpart.com/features/convert-mbr-gpt.html
                                    2⤵
                                    • Enumerates system info in registry
                                    • NTFS ADS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:2752
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1ef46f8,0x7ffde1ef4708,0x7ffde1ef4718
                                      3⤵
                                        PID:5032
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
                                        3⤵
                                          PID:3840
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3252
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
                                          3⤵
                                            PID:2096
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                                            3⤵
                                              PID:4240
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                              3⤵
                                                PID:3848
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                                                3⤵
                                                  PID:4608
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                                                  3⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                                                  3⤵
                                                    PID:5004
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                                                    3⤵
                                                      PID:4504
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                                      3⤵
                                                        PID:3344
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                                        3⤵
                                                          PID:4452
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
                                                          3⤵
                                                            PID:2216
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                            3⤵
                                                              PID:5184
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                                                              3⤵
                                                                PID:5452
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                                                3⤵
                                                                  PID:5664
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                                                  3⤵
                                                                    PID:5824
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
                                                                    3⤵
                                                                      PID:5884
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4956 /prefetch:8
                                                                      3⤵
                                                                        PID:3436
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                                                                        3⤵
                                                                          PID:956
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6332 /prefetch:8
                                                                          3⤵
                                                                            PID:5360
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5352 /prefetch:8
                                                                            3⤵
                                                                              PID:3244
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                                                              3⤵
                                                                                PID:688
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
                                                                                3⤵
                                                                                  PID:4720
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                                                                  3⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:2564
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3576 /prefetch:8
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:6600
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:6712
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3302358283804301456,934993412026620440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3520 /prefetch:2
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:8136
                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                fsutil behavior set disablelastaccess 1
                                                                                2⤵
                                                                                  PID:5068
                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                  sc stop "PcaSvc"
                                                                                  2⤵
                                                                                    PID:4244
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc config "PcaSvc" start=disabled
                                                                                    2⤵
                                                                                    • Launches sc.exe
                                                                                    PID:4528
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                    2⤵
                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4604
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                    2⤵
                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:3088
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                    2⤵
                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:3680
                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                    fsutil usn deletejournal /d C:
                                                                                    2⤵
                                                                                    • Deletes NTFS Change Journal
                                                                                    PID:4648
                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                    fsutil usn deletejournal /d D:
                                                                                    2⤵
                                                                                    • Deletes NTFS Change Journal
                                                                                    • Enumerates connected drives
                                                                                    PID:4696
                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                    fsutil usn deletejournal /d F:
                                                                                    2⤵
                                                                                    • Deletes NTFS Change Journal
                                                                                    • Enumerates connected drives
                                                                                    PID:4388
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc stop "SysMain"
                                                                                    2⤵
                                                                                      PID:4504
                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                      sc config "SysMain" start=disabled
                                                                                      2⤵
                                                                                        PID:3596
                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                        sc stop "SuperFetch"
                                                                                        2⤵
                                                                                          PID:1612
                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                          sc config "SuperFetch" start=disabled
                                                                                          2⤵
                                                                                            PID:688
                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                            fsutil behavior set disablelastaccess 1
                                                                                            2⤵
                                                                                              PID:1232
                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                              sc stop "PcaSvc"
                                                                                              2⤵
                                                                                                PID:3168
                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                sc config "PcaSvc" start=disabled
                                                                                                2⤵
                                                                                                  PID:3604
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                  2⤵
                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1400
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                  2⤵
                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:3956
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                  2⤵
                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:2224
                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                  fsutil usn deletejournal /d C:
                                                                                                  2⤵
                                                                                                  • Deletes NTFS Change Journal
                                                                                                  PID:916
                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                  fsutil usn deletejournal /d D:
                                                                                                  2⤵
                                                                                                  • Deletes NTFS Change Journal
                                                                                                  • Enumerates connected drives
                                                                                                  PID:4240
                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                  fsutil usn deletejournal /d F:
                                                                                                  2⤵
                                                                                                  • Deletes NTFS Change Journal
                                                                                                  • Enumerates connected drives
                                                                                                  PID:3140
                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                  sc stop "SysMain"
                                                                                                  2⤵
                                                                                                    PID:3956
                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                    sc config "SysMain" start=disabled
                                                                                                    2⤵
                                                                                                      PID:1400
                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                      sc stop "SuperFetch"
                                                                                                      2⤵
                                                                                                        PID:4624
                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                        sc config "SuperFetch" start=disabled
                                                                                                        2⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:1400
                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                        fsutil behavior set disablelastaccess 1
                                                                                                        2⤵
                                                                                                          PID:5292
                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                          sc stop "PcaSvc"
                                                                                                          2⤵
                                                                                                            PID:5348
                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                            2⤵
                                                                                                              PID:5400
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5456
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:5616
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:5776
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d C:
                                                                                                              2⤵
                                                                                                              • Deletes NTFS Change Journal
                                                                                                              PID:5928
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d D:
                                                                                                              2⤵
                                                                                                              • Deletes NTFS Change Journal
                                                                                                              • Enumerates connected drives
                                                                                                              PID:5980
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d F:
                                                                                                              2⤵
                                                                                                              • Deletes NTFS Change Journal
                                                                                                              • Enumerates connected drives
                                                                                                              PID:6032
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc stop "SysMain"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:6084
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc config "SysMain" start=disabled
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:6128
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc stop "SuperFetch"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:2924
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:688
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil behavior set disablelastaccess 1
                                                                                                              2⤵
                                                                                                                PID:5288
                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                sc stop "PcaSvc"
                                                                                                                2⤵
                                                                                                                  PID:5308
                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                  sc config "PcaSvc" start=disabled
                                                                                                                  2⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:5428
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                  2⤵
                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                  PID:5480
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                  2⤵
                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                  PID:5712
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                  2⤵
                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                  PID:5880
                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                  fsutil usn deletejournal /d C:
                                                                                                                  2⤵
                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                  PID:5968
                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                  fsutil usn deletejournal /d D:
                                                                                                                  2⤵
                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                  • Enumerates connected drives
                                                                                                                  PID:6016
                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                  fsutil usn deletejournal /d F:
                                                                                                                  2⤵
                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                  • Enumerates connected drives
                                                                                                                  PID:6068
                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                  sc stop "SysMain"
                                                                                                                  2⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:6120
                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                  sc config "SysMain" start=disabled
                                                                                                                  2⤵
                                                                                                                    PID:5052
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    sc stop "SuperFetch"
                                                                                                                    2⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:2236
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    sc config "SuperFetch" start=disabled
                                                                                                                    2⤵
                                                                                                                      PID:2136
                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                      fsutil behavior set disablelastaccess 1
                                                                                                                      2⤵
                                                                                                                        PID:6004
                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                        sc stop "PcaSvc"
                                                                                                                        2⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:6040
                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                        sc config "PcaSvc" start=disabled
                                                                                                                        2⤵
                                                                                                                          PID:6072
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                          2⤵
                                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                                          PID:6132
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                          2⤵
                                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                                          PID:5148
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                          2⤵
                                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                                          PID:5372
                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                          fsutil usn deletejournal /d C:
                                                                                                                          2⤵
                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                          PID:5588
                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                          fsutil usn deletejournal /d D:
                                                                                                                          2⤵
                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                          • Enumerates connected drives
                                                                                                                          PID:5476
                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                          fsutil usn deletejournal /d F:
                                                                                                                          2⤵
                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                          • Enumerates connected drives
                                                                                                                          PID:5748
                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                          sc stop "SysMain"
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:5252
                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                          sc config "SysMain" start=disabled
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:5184
                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                          sc stop "SuperFetch"
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:5428
                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                          sc config "SuperFetch" start=disabled
                                                                                                                          2⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:6056
                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                          fsutil behavior set disablelastaccess 1
                                                                                                                          2⤵
                                                                                                                            PID:4252
                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                            sc stop "PcaSvc"
                                                                                                                            2⤵
                                                                                                                              PID:5472
                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                              sc config "PcaSvc" start=disabled
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:5404
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                              2⤵
                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                              PID:5308
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                              2⤵
                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                              PID:5292
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                              2⤵
                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                              PID:4576
                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                              fsutil usn deletejournal /d C:
                                                                                                                              2⤵
                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                              PID:5428
                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                              2⤵
                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                              • Enumerates connected drives
                                                                                                                              PID:6040
                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                              2⤵
                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                              • Enumerates connected drives
                                                                                                                              PID:5124
                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                              sc stop "SysMain"
                                                                                                                              2⤵
                                                                                                                                PID:3880
                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                2⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:5664
                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                sc stop "SuperFetch"
                                                                                                                                2⤵
                                                                                                                                  PID:2320
                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                  2⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:2176
                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                  fsutil behavior set disablelastaccess 1
                                                                                                                                  2⤵
                                                                                                                                    PID:5068
                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                    sc stop "PcaSvc"
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:5552
                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                    2⤵
                                                                                                                                      PID:5412
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                      2⤵
                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                      PID:5368
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                      2⤵
                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                      PID:5512
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                      2⤵
                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                      PID:2288
                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                      fsutil usn deletejournal /d C:
                                                                                                                                      2⤵
                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                      PID:5972
                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                      fsutil usn deletejournal /d D:
                                                                                                                                      2⤵
                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      PID:6108
                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                      fsutil usn deletejournal /d F:
                                                                                                                                      2⤵
                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      PID:2236
                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                      sc stop "SysMain"
                                                                                                                                      2⤵
                                                                                                                                        PID:4168
                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                        sc config "SysMain" start=disabled
                                                                                                                                        2⤵
                                                                                                                                          PID:2320
                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                          sc stop "SuperFetch"
                                                                                                                                          2⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          PID:5136
                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                          sc config "SuperFetch" start=disabled
                                                                                                                                          2⤵
                                                                                                                                            PID:1636
                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                            fsutil behavior set disablelastaccess 1
                                                                                                                                            2⤵
                                                                                                                                              PID:2000
                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                              sc stop "PcaSvc"
                                                                                                                                              2⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5460
                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                              sc config "PcaSvc" start=disabled
                                                                                                                                              2⤵
                                                                                                                                                PID:5400
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                2⤵
                                                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                PID:5448
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                2⤵
                                                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                PID:5404
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                2⤵
                                                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                PID:5180
                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                fsutil usn deletejournal /d C:
                                                                                                                                                2⤵
                                                                                                                                                • Deletes NTFS Change Journal
                                                                                                                                                PID:6080
                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                fsutil usn deletejournal /d D:
                                                                                                                                                2⤵
                                                                                                                                                • Deletes NTFS Change Journal
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                PID:6088
                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                fsutil usn deletejournal /d F:
                                                                                                                                                2⤵
                                                                                                                                                • Deletes NTFS Change Journal
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                PID:5980
                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                sc stop "SysMain"
                                                                                                                                                2⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:3880
                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                                2⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:5664
                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                sc stop "SuperFetch"
                                                                                                                                                2⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:2968
                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                sc config "SuperFetch" start=disabled
                                                                                                                                                2⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:6132
                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                2⤵
                                                                                                                                                  PID:5804
                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2816
                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                    2⤵
                                                                                                                                                    • Launches sc.exe
                                                                                                                                                    PID:2112
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                    2⤵
                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                    PID:5380
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                    2⤵
                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                    PID:5652
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                    2⤵
                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                    PID:404
                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                    2⤵
                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                    PID:6076
                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                    2⤵
                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    PID:6016
                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                    2⤵
                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    PID:5300
                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6092
                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                      sc config "SysMain" start=disabled
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2484
                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                        sc stop "SuperFetch"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1648
                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                          sc config "SuperFetch" start=disabled
                                                                                                                                                          2⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:5980
                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                          fsutil behavior set disablelastaccess 1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5608
                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                            sc stop "PcaSvc"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5564
                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                              sc config "PcaSvc" start=disabled
                                                                                                                                                              2⤵
                                                                                                                                                              • Launches sc.exe
                                                                                                                                                              PID:5432
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                              2⤵
                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                              PID:5612
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                              2⤵
                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                              PID:5548
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                              2⤵
                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                              PID:5468
                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                              fsutil usn deletejournal /d C:
                                                                                                                                                              2⤵
                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                              PID:5792
                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                                                              2⤵
                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              PID:6104
                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                                                              2⤵
                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              PID:6088
                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                              sc stop "SysMain"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6116
                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                                                2⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:1340
                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                sc stop "SuperFetch"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3920
                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4168
                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                    fsutil behavior set disablelastaccess 1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5360
                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                      sc stop "PcaSvc"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:5540
                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                      sc config "PcaSvc" start=disabled
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5564
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                        PID:5508
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                        PID:5176
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                        PID:5180
                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                        fsutil usn deletejournal /d C:
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Deletes NTFS Change Journal
                                                                                                                                                                        PID:6004
                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                        fsutil usn deletejournal /d D:
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Deletes NTFS Change Journal
                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                        PID:6124
                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                        fsutil usn deletejournal /d F:
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Deletes NTFS Change Journal
                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                        PID:6112
                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                        sc stop "SysMain"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6100
                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                          sc config "SysMain" start=disabled
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5172
                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                            sc stop "SuperFetch"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3920
                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4916
                                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1816
                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5924
                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:5896
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                    PID:5256
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                    PID:5412
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                    PID:5388
                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                    PID:5192
                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                    PID:4476
                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                    PID:3848
                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:5180
                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                    sc config "SysMain" start=disabled
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3484
                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                      sc stop "SuperFetch"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:836
                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                        sc config "SuperFetch" start=disabled
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3880
                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                          fsutil behavior set disablelastaccess 1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3736
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc stop "PcaSvc"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:3520
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:4888
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                            PID:3580
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                            PID:5956
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                            PID:5440
                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                            PID:4556
                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                            PID:5368
                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                            PID:5140
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc stop "SysMain"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:5576
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc config "SysMain" start=disabled
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:5660
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc stop "SuperFetch"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5496
                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:5916
                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                              fsutil behavior set disablelastaccess 1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5868
                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                sc stop "PcaSvc"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:5444
                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                sc config "PcaSvc" start=disabled
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                  fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                    sc stop "PcaSvc"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                      fsutil usn deletejournal /d C:
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                                                                                      PID:5488
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                      fsutil usn deletejournal /d D:
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                      fsutil usn deletejournal /d F:
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                      sc stop "SysMain"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                        PID:5604
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                        sc config "SysMain" start=disabled
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                          sc stop "SuperFetch"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                          sc config "SuperFetch" start=disabled
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            PID:6076
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            PID:6112
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                            sc stop "SysMain"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:836
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                              sc config "SysMain" start=disabled
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              PID:4408
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:2820
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                  PID:5276
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                  fsutil usn deletejournal /d C:
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                  fsutil usn deletejournal /d D:
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                  fsutil usn deletejournal /d F:
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc stop "SysMain"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc config "SysMain" start=disabled
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc stop "SuperFetch"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                  cmd.exe /C timeout /t 1 /nobreak > nul & del "C:\Users\Admin\AppData\Local\Temp\MfYecZ9i.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                      timeout /t 1 /nobreak
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                      PID:5720
                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -s w32time
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Boot or Logon Autostart Execution: Time Providers
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                  C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                  • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                    C:\Windows\System32\vds.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                    • Suspicious behavior: LoadsDriver
                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1308
                                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\CoronaVirus (1).exe
                                                                                                                                                                                                                          "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Drops desktop.ini file(s)
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                              • C:\Windows\system32\mode.com
                                                                                                                                                                                                                                mode con cp select=1251
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6772
                                                                                                                                                                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                  vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Interacts with shadow copies
                                                                                                                                                                                                                                  PID:1788
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6352
                                                                                                                                                                                                                                  • C:\Windows\system32\mode.com
                                                                                                                                                                                                                                    mode con cp select=1251
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6240
                                                                                                                                                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                      vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Interacts with shadow copies
                                                                                                                                                                                                                                      PID:6224
                                                                                                                                                                                                                                  • C:\Windows\System32\mshta.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6212
                                                                                                                                                                                                                                    • C:\Windows\System32\mshta.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:6168
                                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\CoronaVirus (1).exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6584
                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\RedEye.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Downloads\RedEye.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Drops autorun.inf file
                                                                                                                                                                                                                                        • Sets desktop wallpaper using registry
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • NTFS ADS
                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                        PID:6860
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                                                                                                                                          vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                          PID:7024
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                                                                                                                                          vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                          PID:7052
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                                                                                                                                          vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                          PID:7068
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\NetSh.exe
                                                                                                                                                                                                                                          NetSh Advfirewall set allprofiles state off
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                          PID:7076

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1091

                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                      System Services

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1569

                                                                                                                                                                                                                                      Service Execution

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1569.002

                                                                                                                                                                                                                                      Windows Management Instrumentation

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1047

                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                      Time Providers

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.003

                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                      Image File Execution Options Injection

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1546.012

                                                                                                                                                                                                                                      Netsh Helper DLL

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1546.007

                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                      Server Software Component

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1505

                                                                                                                                                                                                                                      Terminal Services DLL

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1505.005

                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                      Time Providers

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1547.003

                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                      Image File Execution Options Injection

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1546.012

                                                                                                                                                                                                                                      Netsh Helper DLL

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1546.007

                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                      Direct Volume Access

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1006

                                                                                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1564

                                                                                                                                                                                                                                      Ignore Process Interrupts

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1564.011

                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1562.004

                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                      Indicator Removal

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1070

                                                                                                                                                                                                                                      File Deletion

                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                      T1070.004

                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                      Windows Credential Manager

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1555.004

                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                      7
                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                      System Time Discovery

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1124

                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1091

                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                      Data Destruction

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1485

                                                                                                                                                                                                                                      Defacement

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1491

                                                                                                                                                                                                                                      Inhibit System Recovery

                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                      T1490

                                                                                                                                                                                                                                      Service Stop

                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                      T1489

                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-E974AB27.[[email protected]].ncov
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        8411831739eee12d965d48e6607a65d8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8660006203dcf6555bb432284d68c00566b45c46

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        4df4db757da3c481c3c823a15969045d9857d2e97882ea7ebf80ef5147414e1b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        968d23480f52249f48e4b0f34142c5172b1bb9598ba99646d7153f4aa69c3e5871f48982c39d0075c748ef5801fc6876ebbd0c0ba4ca7a98641e4b84b9c2f800

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        10e624ec749193e3ec4e8e73e2d74ccd

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        a4200f61c224af1af1e58eec4c83623b2851729c

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ee3ab03ec8e520c50ab249e06c76761e988a674ddc4fa4bf58cf7e66c8a099a1

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        cae9adc6aaf954d1f999f3c6540c0a3060e74b80b5644118c1e87c37dd47e5576cf315b58d76c0cdeb95dc9cdfb2511763f7fa6873662c47c3f8e76c8602c481

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d22073dea53e79d9b824f27ac5e9813e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6d8a7281241248431a1571e6ddc55798b01fa961

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        bffcefacce25cd03f3d5c9446ddb903d

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8923f84aa86db316d2f5c122fe3874bbe26f3bab

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        055d1462f66a350d9886542d4d79bc2b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        f1086d2f667d807dbb1aa362a7a809ea119f2565

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2a5ce7a6c21384bf768735e0afbd053b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        7854ecad2ad71a80e31efcde0992a0dd78efa1a0

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        19c268a84664155e97f584b5a365399dea3e2c8f3a93f7ce9b904955aa6aab5d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bf58eef4d2081e061647dcaa0b1db7e274bcf1f581b48fbef070b9b371240fcd3f98eca95b44e8b4754615d3b9de0baa5a4ae65b8d6a6a852246bb1d5196dabe

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a34a317782e824d5d903867071a8e783

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6fca7875116655d46d7eee8d0ef1710323cbfba2

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a8a1a484a9ba7a984b2dab6a37feb2a21ff755d159ab061f51cbb341935a7d5e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        34d05ddab014ae8639857134d6043832913cbfe46aa2bf032c006a791c9248a61e8ca5cb9fb6063d08355d44f844e7582cfb67b3bbbe79be2c4028daf1760a4b

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        dcc336aa325f35c0ed6511403067c3e0

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        dcf9be25ff8fd7b506237eb5a9c30220382a3530

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6710ce8661cda5e57907926ec8f72cf866f65e96c9d7560f727a0b659ffbfbf5

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        e2223a164d7c39adaa80ed9fa1e8b5c88a5b0fdb51ed72975aabf6895e60da6bc968796ae7641f811a54ce9f07c46bf1d2329890066d6f5d8a32f25e274fdbde

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b88aab103945c2aa391be7a616377374

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e9924ef6ff033fafc98b5ac0b09f0f1bae7b6d19

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        84ee20952503a350994331d9a7b9c03654b01eb817576a2416de514b04bd154f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3d7bd5857ec24e37457f931823baae4800b3d96c556895bc181922eb3925c5900fc1ac5dd726be2d9cccd3c0150689aaee688be215941529afc298a0b28a040c

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        4bdd7899b7a1ce0d9b56d07a4d07e0a8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        74cdf04dfc0dc5396fe35978ea4527f897f73350

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        149328436d5ec4ca2d94fcd3c3fc80b1694a849bbf3c0b8032adf6205f938f7e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        34a3de63cf4dae06e9f4b0e870d580f3b68222ed2687cda3b04d17ec12bab0c520515ebdd077651113c3060b03a317f7a7b6dfa5974bdc0008c3ab67c00ba032

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        497fec30d38b8ca03d129ae683eccbae

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9377ad494c58307c8878b94ff947d49b4aa9f8f4

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        0407c8be830a5bdaf94a1909d16184928af3ffd62c1cd53ebc6721616928349b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7ae70cf535ab491380be5e49e27098592e570fe72a915bded8fdb3fe6ff513cd8725c5605e12879fc7a228ace07e1e78056de636898a29d918d86691519fa5e8

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        861bb9e09bf9962b5f3d4f9e23bf052e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b4a814471cf022ac644a236ce86f95d26145c0ef

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        1df5c3cec510551a19d6772a4f9fce67c81667a8cc9300f6a9c18b8efe71ff27

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        be8f22cecd337301e92df2dc81f0ad8b9457939a8d4df06c4cf04fb6bab8748cac8cf3a1a1f57752170d665faa48d6a662b2aa05c33215693c9c554c598e04cc

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e37a71a523f39a78c7bd9dbf5fb96c6c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        45d2e21afde824bbc3e8446cb78d51f3d96800db

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6f06c7559a029aadccb921a6bb9a9d5327a79034c51e11bc7d26a11cdb427640

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        40387fa62c776fbacc73f42e34c38155ec5e1191f2a37288d5a05aab31aac94034c2f1a6cd49a05d93d8ff86dd70301e1652dd5afaaa7b3625cf8c81d7a59480

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        4f60ddafaf177c698ff9346d72d53628

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        75e1147f2f9a997683b5f91abe2828513ca0dd4d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a91fd0ab4cb56cfe9fb0e3354bba8bc6469eed909759be0859be97e76f2dbb5d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        dd2fc6a2ff701bd53c69293d95e3c270e1d9c5802e81f40970dfde7c8949592bb561ccf14265618af93f08da8ed00f8b61cb7f0ae8a334abe85d00dfe7c7e6ed

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a18125eedcddf7d4324fb7536e01d161

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        38c41267e8165245d3250b2fab405bab66326a2f

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        66d15e982a36f6aaa17cda7b1cd2f4c920ded466255d763c01b35743244f947f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        fa1bdc3957b96fe36b57fc2ab301a219834bca8bf0397cdd128e9807c2c2c9d452f1cd8008813a2e89680bb4ec0e7c066f1c0933d0f754a8c0115ff7026a6d46

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        5c4c291f8e0dca347beddbf0624266ca

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        5953a54e7a4a2b56780d209ab2cd81d0a53043d2

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        57ff41caabc25d1608354b111cd24e6a8904aa30bd32cfb3b9e351f02e3edd19

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        641e9b5dad6ae936b44dcec2e15c05f63dd59f58a5f78a968e085d52b5cd538f33f7057701bf5ac55d794c6ee36d73de367d03224e03227e0b28772ebf4b9906

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f42.TMP
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        371B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d2df49e0053694b7a8af775466d0e18f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0925929613fcc575920b9648c26e36096013cd5b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a51895ab5ad1ad3dad8caa5851beb78cbd91125a1b3d7fcce72dc160ff4a078f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        076bf14826379c5a71b1bb317733ce32e1832dff2e882e6812e0f995a7fb693230edc79dcbde2e7136dc81fc677422431330479dd3d231ea3f2bebb3848d07d9

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5965d4.TMP
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        18ab2e8144572b1fbacf133bf994fbbb

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0405ca95d7bb6b72cac72241d3ab03a0bffc4e96

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b2c7eb1fd0c46e1ccee23cb5fbe78cd49ae20ca2fc79849d853765c772e40e8e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        30c126face6ac65af7c427c22d92188af743a1e3d2433a46a0207802ef59fe5da8578232b3f24ee3bc8920d46585db4b85676f8d95101494cff4a3947f851254

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3cf7a830d66b98cb5537f94cd0b87cdd

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        d751129adf4632519d94ad17a9d74348a36d1e27

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        f215335fef27fe48f9b4a5340b16dd92d1bf961e01b3e98eefc431b60fe5f15a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        c9d488564b9075458175c70fe9b5cd01a85cbf7613f082c1b593a9d3eaf563933a37ec6a1f9dfed0efb9109bb519062cba5412cdb381cb9352afa5721662af7b

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        1bb8f6f4f43070f6a47a6801793f749e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        74473654b9e1e1e2701a090292f77e5e1c2da2aa

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        041b8bf6643b821b27bd0b7a8d33a0624725734d77b5a986247cf31f3ce62892

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        96bb353683037a7a8ae9a79efc92974834f35f597ea468f964ec453aec25607dfa009aa7ba2f09a4a759789dbe274164f4cd9ff6e317e5fbd319b652b9692ee1

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        eedfa2ea38b6e72bf2cb0b7bf99e2582

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e3e5aac1fec9fd7e7ea546958bfefb9d0502023c

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c1b7ea3620244995776192bd14efdd7477d41c19e4c7367e005b08fa2179a3eb

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        6d22ab65296bf5a35eaeb30f9b0c6d22c5db00e981ae2a6a796971f8b939af617295b072ff7a43a49f9a379718634e0f49757b9ef0b74452da00492754a05485

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        95b7b0872a81ae4329440a0812af4eac

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        facbdb5356b3341d47239d8d494185d97563eefa

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        2b457a34a0c728eec513fd5eec42226e75c2d58ff73ff60f59f87399e9e370d5

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        474146d68015a51d6104c8e5217a2e8f017f60c71294a47716eb14c874243a996977e31d30a7d80b263e0ba731d2dd917e165552efb3b2b1f0aaa4f4f00806f9

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        dab881e3eedccb2de1c0788303ac393e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        bc89edbcc664643447326656d6d1e387a4355cf5

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        09718b651ff160a31e5895981b5cfa70e9c3e8c2b8cf802ddd4920ab85ec56f1

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3b9980dc5fa5f4f006658a3ccfe196fc6bd0e5f80d6d97b908e82b842a996e23181f8d817202801362c10257cbd6de1ca214610d6ad13131f02ac19e079ca3b8

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        446dd1cf97eaba21cf14d03aebc79f27

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1020B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f7008ed1313695169be572150801235c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        c14a9659b8c619060ccd826002cb31ef6da24b69

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        e255e081f9ad6eb39ec2912a50720570563621bf6ecdcd6036ec94c6a4b30751

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        027df89bf352f08b56df82d8cb00e1699b4d1f3e5799047beb967d189a414a98257eab11b8b96f445ff0e67e9a87d21cc926a425bac6996a29abf043f5cc8aa0

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l2b4w15k.qbx.ps1
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 681421.crdownload
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        10.6MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e9e5596b42f209cc058b55edc2737a80

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        f30232697b3f54e58af08421da697262c99ec48b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        e542319beb6f81b493ad80985b5f9c759752887dc3940b77520a3569cd5827de2fcae4c2357b7f9794b382192d4c0b125746df5cf08f206d07b2b473b238d0c7

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • C:\Windows\System32\Recovery\ReAgent.xml
                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        bdefeb1aa8afa75e36bcc68613412e75

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        68d92774e5695971aea5acc61a74c62dbb43efab

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c5c3e183e13c2dc76eee80639bfdecc0ec64f0bae1b3b94561e037a52c989046

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5b15c1e47305f19cc6659e026e67da1c9a649784c7f21a6f20f42442669d346fa7ad52d95e579fea83389b1214ab21c4be940ba93335be5b10063580bd1ab94c

                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                      • memory/1600-20-0x00007FFDFF650000-0x00007FFDFF845000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/1600-17-0x00000187F4C50000-0x00000187F4C72000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/1600-6-0x00007FFDFF650000-0x00007FFDFF845000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/1600-7-0x00007FFDFF650000-0x00007FFDFF845000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-443-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-1195-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-869-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-741-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-0-0x00007FFDFF6F0000-0x00007FFDFF6F2000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-1142-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-975-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-5-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-300-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-1-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-159-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-2-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-3-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-4-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/2108-32-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/4316-1164-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/4316-5300-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/4316-1218-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/6060-13081-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/6060-10905-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/6860-26604-0x00000130EE2D0000-0x00000130EED6C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        10.6MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/6860-26605-0x00000130F1390000-0x00000130F23A6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        16.1MB

                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                      • memory/6860-26606-0x00000130EF1A0000-0x00000130EF1A6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                        Download