hxxps://drive[.]google[.]com/file/d/1e9sQz-FLV3_rq4CMNanNH7VAbkFvpv3G/view?usp=drive_link

Analysis

max time kernel
970s
max time network
978s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
15-10-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1e9sQz-FLV3_rq4CMNanNH7VAbkFvpv3G/view?usp=drive_link

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk	Rainmeter-4.5.20.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 18 IoCs

pid	Process
2192	Rainmeter.exe
2216	Rainmeter.exe
560	7zG.exe
3060	Rainmeter.exe
3016	SkinInstaller.exe
1420	Rainmeter.exe
912	7zG.exe
4068	7zG.exe
4892	NexusSetup.exe
1188	NexusSetup.tmp
2968	WsxService.exe
5008	WsxService.exe
4700	Nexus.exe
3908	winstep.exe
4100	winstep.exe
2480	wsupdate.exe
3848	WinLaunch.exe
3312	WinLaunch.exe

Loads dropped DLL 31 IoCs

pid	Process
4076	Rainmeter-4.5.20.exe
4076	Rainmeter-4.5.20.exe
4076	Rainmeter-4.5.20.exe
4076	Rainmeter-4.5.20.exe
2192	Rainmeter.exe
2216	Rainmeter.exe
560	7zG.exe
3060	Rainmeter.exe
3016	SkinInstaller.exe
1420	Rainmeter.exe
912	7zG.exe
4068	7zG.exe
4840	regsvr32.exe
4840	regsvr32.exe
3760	regsvr32.exe
1456	regsvr32.exe
1456	regsvr32.exe
4808	regsvr32.exe
2968	WsxService.exe
5008	WsxService.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
3908	winstep.exe
4700	Nexus.exe
4100	winstep.exe
4700	Nexus.exe
2480	wsupdate.exe
3848	WinLaunch.exe
3312	WinLaunch.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nexus	NexusSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\Run\NeXuS = "C:\\Program Files (x86)\\Winstep\\Nexus.exe autostart"	Nexus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinLaunch = "C:\\Program Files\\WinLaunch\\WinLaunch.exe -hide"	WinLaunchInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinLaunch = "C:\\Program Files\\WinLaunch\\WinLaunch.exe -hide"	WinLaunch.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Public\Documents\WinStep\Themes\Male Voice\desktop.ini	Nexus.exe
File opened for modification	C:\Users\Public\Documents\WinStep\Themes\Male Voice\desktop.ini	Nexus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm50.dll	NexusSetup.tmp
File created	C:\Windows\SysWOW64\is-2KI2S.tmp	NexusSetup.tmp
File created	C:\Windows\SysWOW64\is-7S3SA.tmp	NexusSetup.tmp
File created	C:\Windows\SysWOW64\is-556RM.tmp	NexusSetup.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Plugins\WindowMessagePlugin.dll	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Languages\1055.dll	Rainmeter-4.5.20.exe
File created	C:\Program Files (x86)\Winstep\is-1NNI4.tmp	NexusSetup.tmp
File opened for modification	C:\Program Files\WinLaunch\he-IL\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\WinLaunch\tr-TR\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Plugins\ResMon.dll	Rainmeter-4.5.20.exe
File created	C:\Program Files\Rainmeter\Defaults\Skins\illustro\Clock\Clock.ini	Rainmeter-4.5.20.exe
File created	C:\Program Files\Rainmeter\Defaults\Skins\illustro\System\System.ini	Rainmeter-4.5.20.exe
File created	C:\Program Files (x86)\Winstep\Help\Nexus\is-904UG.tmp	NexusSetup.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File created	C:\Program Files (x86)\Winstep\is-5NA9Q.tmp	NexusSetup.tmp
File created	C:\Program Files (x86)\Winstep\is-UPLSP.tmp	NexusSetup.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Languages\1046.dll	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Defaults\Skins\illustro\Recycle Bin\Recycle Bin.ini	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File created	C:\Program Files\WinLaunch\he-IL\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\WinLaunch\Setup.exe	WinLaunchInstaller.exe
File created	C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files (x86)\Winstep\WsxService.exe	NexusSetup.tmp
File created	C:\Program Files (x86)\Winstep\is-LBFPU.tmp	NexusSetup.tmp
File opened for modification	C:\Program Files (x86)\Winstep\unins000.dat	NexusSetup.tmp
File created	C:\Program Files\WinLaunch\XInputInterface.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files (x86)\Winstep\Help\Nexus\German.chm	NexusSetup.tmp
File opened for modification	C:\Program Files (x86)\Winstep\WsTranslator.exe	NexusSetup.tmp
File created	C:\Program Files\Rainmeter\Languages\1031.dll	Rainmeter-4.5.20.exe
File created	C:\Program Files\Rainmeter\Languages\1045.dll	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files (x86)\Winstep\wsunzip.dll	NexusSetup.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\RestartRainmeter.exe	Rainmeter-4.5.20.exe
File created	C:\Program Files (x86)\Winstep\is-I2L3R.tmp	NexusSetup.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File created	C:\Program Files\Rainmeter\Languages\1036.dll	Rainmeter-4.5.20.exe
File created	C:\Program Files\WinLaunch\da-DK\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\WinLaunch\fr-FR\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File created	C:\Program Files\WinLaunch\ja-JP\WinLaunch.resources.dll	WinLaunchInstaller.exe
File created	C:\Program Files\WinLaunch\WinLaunch.exe	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\WinLaunch\pt-BR\WinLaunch.resources.dll	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\WinLaunch\WinLaunch.exe	WinLaunchInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File created	C:\Program Files\WinLaunch\pt-BR\WinLaunch.resources.dll	WinLaunchInstaller.exe
File created	C:\Program Files\Rainmeter\Rainmeter.VisualElementsManifest.xml	Rainmeter-4.5.20.exe
File created	C:\Program Files\Rainmeter\Plugins\PerfMon.dll	Rainmeter-4.5.20.exe
File created	C:\Program Files\Rainmeter\Languages\1043.dll	Rainmeter-4.5.20.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Fonts\digital-7 (mono).ttf	WsxService.exe
File opened for modification	C:\Windows\Fonts\LCDM2L__.TTF	WsxService.exe
File created	C:\Windows\Fonts\LCDM2N__.TTF	WsxService.exe
File created	C:\Windows\Fonts\LCDM2U__.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\LCDM2U__.TTF	WsxService.exe
File created	C:\Windows\Fonts\LCDM2B__.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\LCDM2N__.TTF	WsxService.exe
File created	C:\Windows\Fonts\dungeon.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\dungeon.TTF	WsxService.exe
File created	C:\Windows\Fonts\HOOG0553.TTF	WsxService.exe
File created	C:\Windows\Fonts\HOOG0555.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\HOOG0555.TTF	WsxService.exe
File created	C:\Windows\Fonts\digital-7 (mono).ttf	WsxService.exe
File opened for modification	C:\Windows\Fonts\HOOG0553.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\LCDM2B__.TTF	WsxService.exe
File created	C:\Windows\Fonts\LCDM2L__.TTF	WsxService.exe
File created	C:\Windows\Fonts\HOOG0554.TTF	WsxService.exe
File opened for modification	C:\Windows\Fonts\HOOG0554.TTF	WsxService.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winstep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rainmeter-4.5.20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WsxService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nexus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winstep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WsxService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3364	cmd.exe
1948	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Nexus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Nexus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Nexus.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "5.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C119089-DB9C-11D2-9AA5-0020A90A358B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C104B7C-C25F-4439-9416-39EFAC33F894}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NextControls.Xpto\Clsid\ = "{BA3303D5-580D-11D3-9AA5-00000100673E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11909E-DB9C-11D2-9AA5-0020A90A358B}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11908D-DB9C-11D2-9AA5-0020A90A358B}\Version\ = "4.9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nexus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42DEF5B7-CC90-4A06-8716-1BBB675112C6}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11909E-DB9C-11D2-9AA5-0020A90A358B}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11909B-DB9C-11D2-9AA5-0020A90A358B}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\NextControls.ocx, 30009"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WinLaunch.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\Version = "5.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C119089-DB9C-11D2-9AA5-0020A90A358B}\TypeLib\Version = "4.9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C97E005E-03CE-11D3-9AA5-00000100673E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA3303D5-580D-11D3-9AA5-00000100673E}\ = "NextControls.Xpto"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CA4FD6F-0818-11D3-9AA5-00000100673E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11908A-DB9C-11D2-9AA5-0020A90A358B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\ = "ITab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ = "IProgressBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48817304-8DB3-48DB-B4D5-6CE8B83D687A}\TypeLib\ = "{EE74AD62-C2F7-11D2-9AA5-0020A90A358B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA3303D6-580D-11D3-9AA5-00000100673E}\TypeLib\Version = "4.9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WinLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0\0	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\toxtreme\command	NexusSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C11909F-DB9C-11D2-9AA5-0020A90A358B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C11908D-DB9C-11D2-9AA5-0020A90A358B}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C11909D-DB9C-11D2-9AA5-0020A90A358B}\TypeLib\ = "{EE74AD62-C2F7-11D2-9AA5-0020A90A358B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WsxMMTimer.ITimer\ = "WsxMMTimer.ITimer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAE2B582-26BC-4872-9676-E721A4F68D4E}	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nexus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CA4FD6F-0818-11D3-9AA5-00000100673E}\Forward\ = "{4B36653D-9063-445F-A496-3D484FB7DE8A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NextControls.NxList\Clsid\ = "{5C119095-DB9C-11D2-9AA5-0020A90A358B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\comctl32.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B039FF7A-CE35-4622-B4E3-B8A60D3BBC00}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	Nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2C3DF16-6F54-435B-8313-1B1BA4D3344A}\TypeLib\ = "{EE74AD62-C2F7-11D2-9AA5-0020A90A358B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C1190A0-DB9C-11D2-9AA5-0020A90A358B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C119095-DB9C-11D2-9AA5-0020A90A358B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A0-850A-101B-AFC0-4210102A8DA7}\ = "IPanels10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\1	WinLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C97E005E-03CE-11D3-9AA5-00000100673E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA3303D4-580D-11D3-9AA5-00000100673E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C97E005F-03CE-11D3-9AA5-00000100673E}\TypeLib\Version = "4.9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CA4FD6F-0818-11D3-9AA5-00000100673E}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Windows to MacOS.zip:Zone.Identifier	msedge.exe
File created	C:\Program Files\WinLaunch\Setup.exe\:Zone.Identifier:$DATA	WinLaunchInstaller.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1948	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
3092	msedge.exe
3092	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
3028	msedge.exe
3028	msedge.exe
1320	msedge.exe
1320	msedge.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1780	taskmgr.exe
3016	SkinInstaller.exe
4700	Nexus.exe
3848	WinLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	taskmgr.exe
Token: SeSystemProfilePrivilege	1780	taskmgr.exe
Token: SeCreateGlobalPrivilege	1780	taskmgr.exe
Token: 33	1780	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1780	taskmgr.exe
Token: SeRestorePrivilege	912	7zG.exe
Token: 35	912	7zG.exe
Token: SeSecurityPrivilege	912	7zG.exe
Token: SeSecurityPrivilege	912	7zG.exe
Token: SeRestorePrivilege	4068	7zG.exe
Token: 35	4068	7zG.exe
Token: SeSecurityPrivilege	4068	7zG.exe
Token: SeSecurityPrivilege	4068	7zG.exe
Token: SeShutdownPrivilege	4700	Nexus.exe
Token: SeCreatePagefilePrivilege	4700	Nexus.exe
Token: 33	2340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2340	AUDIODG.EXE
Token: SeSystemtimePrivilege	5008	WsxService.exe
Token: SeSystemtimePrivilege	5008	WsxService.exe
Token: SeDebugPrivilege	1652	WinLaunchInstaller.exe
Token: SeDebugPrivilege	3848	WinLaunch.exe
Token: SeDebugPrivilege	3312	WinLaunch.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2192	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
2216	Rainmeter.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
488	7z2408-x64.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
1780	taskmgr.exe
2968	WsxService.exe
5008	WsxService.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
3908	winstep.exe
4100	winstep.exe
2480	wsupdate.exe
2480	wsupdate.exe
2356	MiniSearchHost.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
4700	Nexus.exe
3848	WinLaunch.exe
3848	WinLaunch.exe
3848	WinLaunch.exe
3312	WinLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4944	3092	msedge.exe	77
PID 3092 wrote to memory of 4944	3092	msedge.exe	77
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 244	3092	msedge.exe	78
PID 3092 wrote to memory of 2540	3092	msedge.exe	79
PID 3092 wrote to memory of 2540	3092	msedge.exe	79
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80
PID 3092 wrote to memory of 2480	3092	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1e9sQz-FLV3_rq4CMNanNH7VAbkFvpv3G/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe06283cb8,0x7ffe06283cc8,0x7ffe06283cd8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,4482180983981355347,1269136340961143689,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4780

C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\7z2408-x64.exe
"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\7z2408-x64.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:488

C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\Rainmeter-4.5.20.exe
"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\Rainmeter-4.5.20.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4076
- C:\Program Files\Rainmeter\Rainmeter.exe
  "C:\Program Files\Rainmeter\Rainmeter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2192

C:\Program Files\Rainmeter\Rainmeter.exe
"C:\Program Files\Rainmeter\Rainmeter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2216

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\macOS Theme\" -spe -an -ai#7zMap27646:152:7zEvent1095
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1780
- C:\Program Files\Rainmeter\Rainmeter.exe
  "C:\Program Files\Rainmeter\Rainmeter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3060

C:\Program Files\Rainmeter\SkinInstaller.exe
"C:\Program Files\Rainmeter\SkinInstaller.exe" C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\macOS Theme\1. macOS Top Bar.rmskin
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3016
- C:\Program Files\Rainmeter\Rainmeter.exe
  "C:\Program Files\Rainmeter\Rainmeter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1420

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\Aerial_1.0.5.0\" -spe -an -ai#7zMap9991:158:7zEvent333
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\nexus\" -spe -an -ai#7zMap12583:140:7zEvent24909
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\nexus\NexusSetup.exe
"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\nexus\NexusSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4892
- C:\Users\Admin\AppData\Local\Temp\is-ILADO.tmp\NexusSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ILADO.tmp\NexusSetup.tmp" /SL5="$605FA,39685280,410624,C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\nexus\NexusSetup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1188
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\NextControls.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4840
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\comctl32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3760
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Winstep\WsxMMTimer.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1456
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Winstep\wodTelnetDLX.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4808
- - C:\Program Files (x86)\Winstep\WsxService.exe
    "C:\Program Files (x86)\Winstep\WsxService.exe" install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2968
- - C:\Program Files (x86)\Winstep\Nexus.exe
    "C:\Program Files (x86)\Winstep\Nexus.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4700
  - - C:\Program Files (x86)\Winstep\winstep.exe
      "C:\Program Files (x86)\Winstep\winstep.exe" /recycle 197542
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3908
  - - C:\Program Files (x86)\Winstep\winstep.exe
      "C:\Program Files (x86)\Winstep\winstep.exe" /recycle 197542
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4100
  - - C:\Program Files (x86)\Winstep\wsupdate.exe
      "C:\Program Files (x86)\Winstep\wsupdate.exe" verbose
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2480
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:1716

C:\Program Files (x86)\Winstep\WsxService.exe
"C:\Program Files (x86)\Winstep\WsxService"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4952

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1548

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1864

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:196

C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\WinLaunchInstaller.exe
"C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\WinLaunchInstaller.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1652
- C:\Windows\explorer.exe
  "explorer" C:\Program Files\WinLaunch\WinLaunch.exe
  2⤵
  PID:2064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:344
- C:\Program Files\WinLaunch\WinLaunch.exe
  "C:\Program Files\WinLaunch\WinLaunch.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3848
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 10 & "C:\Program Files\WinLaunch\WinLaunch.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3364
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 10
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1948
  - - C:\Program Files\WinLaunch\WinLaunch.exe
      "C:\Program Files\WinLaunch\WinLaunch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Winstep\Nexus.exe

Filesize
17.3MB

MD5
9669e9541939c8ee18f9175ecc5d6159

SHA1
58ebbe720b60988bbcf405ca139233220d1b5545

SHA256
91b26fbd13cd54a4f1c7756104f3b36e56d2a758302b1822d4e8ff320a6a86f0

SHA512
adff70eb57ce8eb5e62db413f60720f77e8d251f5f849699e730f3f6ee1880ed862184890d57fe64ccad09482ac529311a3a05a294777f07e51d6556333468d4

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
10KB

MD5
ed230f9f52ef20a79c4bed8a9fefdf21

SHA1
ec0153260b58438ad17faf1a506b22ad0fec1bdc

SHA256
7199b362f43e9dca2049c0eeb8b1bb443488ca87e12d7dda0f717b2adbdb7f95

SHA512
32f0e954235420a535291cf58b823baacf4a84723231a8636c093061a8c64fcd0952c414fc5bc7080fd8e93f050505d308e834fea44b8ab84802d8449f076bc9

Download Submit
C:\Program Files\Rainmeter\Defaults\Layouts\illustro default\Rainmeter.ini

Filesize
698B

MD5
7ed3f1a420c2ba65345af28455a754da

SHA1
798075c46eded535f7a3191b38c5c6128dbfb4af

SHA256
97030b68fafaee7bb69eacb3c737ba0ca0d75b70e805166494b34fc589f1b7d9

SHA512
fd3c12386c671089f7f7ac23450318c64cf69eae908fafcbc264c9d7f842482efdb5667f18c0cd7bd015715d06e43260c394a5ebc9639526eae504614e89aba5

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\@Resources\Background.png

Filesize
1KB

MD5
751ae72195e782cf91732d0e89138582

SHA1
13a3f32b1b34b61a8ea51efb9098ffc82925dd5d

SHA256
ae72127580a6401f4b3cba621267fcb4d13f0547b7ea00d2748a3a3892cb54de

SHA512
00f821d05e77e5a8bd9cfcb7ac3f963a9dc826521aa9192801d8ea38d085651f3cccc4ab306b58d6310d5445b36645849a4df9adbf6befedf17a785e95424ab4

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Clock\Clock.ini

Filesize
2KB

MD5
a23de9c5c90b698420fc8b3517f36598

SHA1
8f872f02bdd7be04d340c4f1d0a97f795cd66f6e

SHA256
45b2d5644208a29e7e90cc74e130c0fb77c35099e9dbd17ffc010080a3ef1d8d

SHA512
c8030bfbde83fab6ebaeef2a080b55cfa463ece91732e79b0c11ff204bf86715095fe128cbbf76d4cc4029880ec97ba6a7b6f14561bdecf790d3d4359e74176a

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\1 Disk.ini

Filesize
3KB

MD5
bd443770cbb26712f476fa3d41ab812c

SHA1
12aa90188125460708af5fa135cff7f1985c6408

SHA256
1e243b7ec358bc79d65da9d5446758cfd567847cf7fea6ce128f4947d04d7346

SHA512
48e1efcd309d9ea9e780ca7873a2996ee3cbd7bacc6f30b6f017df7c76392d34ca3dd847e5d2b4e36bb340ba8e9a8f095efa8a5e0fc5c11b4f73586356cf625c

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\2 Disks.ini

Filesize
5KB

MD5
7215e77b41579b66126d8d010ab6894a

SHA1
47462528453382376fab2ee6985fe6347ffbfc6a

SHA256
3106efa019016e9d84d0ee4e484f45ffc4311617d3ef3ddce74393a6e41952f0

SHA512
b9abb0081838cde464b6047af7f8f6ca983a33c37e32dbd0e43c64e943389051b5daf195e7843dece36dd295bbb6a05be7dec27af810ebb49c31e164b7ce2469

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Google\Google.ini

Filesize
2KB

MD5
bd09d2ec738a5961d283b2e0d1678708

SHA1
c10f4af7c828377b709d66e0ddfbf99ba2b15fbb

SHA256
9b59768e3a736140970c253fe0ceda0c78b47f4007ec62772e9aedf0a0b5457a

SHA512
b0e2ea96b3d635516e31f4714f863d2cbfc5f4f7fcbecaac17de0c6608b3abd1efafcc07b92c94cf4093fc75feeff60362306ad7ba18b1796c92e63ac58fd1d6

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Network\Network.ini

Filesize
4KB

MD5
573339229e8dfd4d57f46145f9099e70

SHA1
6fb4d80c1bf259d20ba906d48eb716df8c519283

SHA256
8509aa1b6e7a873659d5896fd18477f36be0fbff5e425e86951644e9549b3aa7

SHA512
a6239fa54195eee42360f3f5a2df187fbbb55e8c21ea9919e71507524500f4618ecaffa41e2407ae252dc9a3a37434233175f33575878bcc137e18b4c8cce869

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Recycle Bin\Recycle Bin.ini

Filesize
3KB

MD5
14f0547f1b32795714cabd315b64c80b

SHA1
fe8504e6988db711b306586768f9fc7f71c3747e

SHA256
3959453679d3b47df104e28f6ad51476db53630658339355b72400f8a98e512c

SHA512
46dfab176f225120ef9ae4a44cf0c1a8c3a291ea75abfe779199d350831301b81410b3cf32763f23b9e5e4f2fd828ede67618e978b37e7afabc5d202a0dee02a

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\System\System.ini

Filesize
4KB

MD5
e7c252045282bcc9b1e5675865d8408c

SHA1
2d035d8c608afd1cdcbaa931b1a170de06e60910

SHA256
a2298019b2774ef5f7fa1d22d08738f36e7749ea125bf441a6b8bad23b960826

SHA512
8444337335973db2a6578d49332ccbe5b2e151aac8428b9f6da92f184af91c782a4b6e15164162db85dedcaca3524804ef31a2da90a359e88af9e609f3ef01c5

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Background.png

Filesize
1KB

MD5
27c60fa5b6e8c9545c885f108f501a36

SHA1
58439914234e29a6e8973328dae945ec2fc569ce

SHA256
3aea0caa797e487abb0901648773251ca52f14b680a960baee080f263d2dd9ec

SHA512
26f6a7057f31aab9b88ed5fd779e83e82d32205eb568c46f4fbe93a79182e1f09e00a06d842fea180c2ee469510ad08e26fb8cd08228e3ad6f037802b2b965d1

Download Submit
C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Welcome.ini

Filesize
3KB

MD5
9fd985ded033fa0fcc86c222e8e4370d

SHA1
83615886c788f272078fbbe02e1f8af87ca1ef4e

SHA256
6b710c75c1bfc4046ce0bdcde3c4f920aaefe1ecd4fa186d3bdfee12af897707

SHA512
4165e953773328557f42f1f8a29f0b566bcd5c347b8d5e9586ba09f2a4283a64e6f0ae6aa0ea0ba2b6ae8b0598ca4fed7e6878969eed371a1e6fe6dd23695c3c

Download Submit
C:\Program Files\Rainmeter\Languages\3082.dll

Filesize
16KB

MD5
466a834d75e06f59bab79c3ed97a9a76

SHA1
3c3cf65c95178f52902e721ff166ecc84df07f21

SHA256
9914b051773cdbaf643ad34ae4f0bfbab0f73929d627baf0416881ab7ac3a659

SHA512
b0ee4f67cc94ff6428350fc37474910ab598784767a21e049f66b944589b5f48f4220c534cb9c79d528bfa91a879819f66fce21277c23d6fdaa660687e23120b

Download Submit
C:\Program Files\Rainmeter\Rainmeter.dll

Filesize
2.5MB

MD5
0658cb31cfcb7bda7f98c9a856c7fa16

SHA1
176cb1121d30f4ad3d7190faa6c41ffe018e8534

SHA256
ee383a2d401f8c5569f267c93804e4371e6f6543ed01cfcce5dcefa5091c19b0

SHA512
10ec757aa5913f60e8a28158a87d8918acb3ea4252176773612099b4993592139d46d70123cdfaf38a224b8e51f4b404230070edc2fd0b74eee8f071938bf026

Download Submit
C:\Program Files\Rainmeter\Rainmeter.exe

Filesize
458KB

MD5
9d84ee1acd3e3bd55d0b1c997316f00a

SHA1
471823ba11ab7402b1b7c8035651b4d71adf34c2

SHA256
825897feed83fb9b8881943177741723746ac876e3d8485b759f0e53af52566b

SHA512
ac5794bb9abe164c2b5b08d7135cfe419601af4944c844682d762aad4c71f76ada7d65e2248bb645a420d90322a9d8ebccca083fc54b287d250660b21f469a17

Download Submit
C:\Program Files\Rainmeter\Rainmeter.exe.Config

Filesize
225B

MD5
150de4d93067ceb1bb07c2e60fd75cb4

SHA1
134d4f64bb1b05896db12b5abdc29917953f5b0a

SHA256
e46068c9a86eff44d657a2221b128558468820776bb5902cb5948525f642ad3d

SHA512
0dbe4b6dba3fcddefe773b32a20e1123b55d08747e95dfa0b152ce5645b1140a3d0bf5425bda60cf6013278efd0904c38f90b0bd5072f7ab89d0e00326c1c4ed

Download Submit
C:\Program Files\Rainmeter\SkinInstaller.exe

Filesize
455KB

MD5
a0c512136e758d9490ea93bbb8cc11b2

SHA1
8f8adb3ea472d5d853d5a70bd7df6c353a730569

SHA256
ce6ffa366aa6a70f154687a1ac839956685d3b5dcaaadd04537a32cae747725f

SHA512
957838fb87567caf6872e620c32b1830151c6f439adf706c40b9e006296a42957c9b4238a7dccb395ec0744df141b300e20de5a7774caf7245340e5e9012070d

Download Submit
C:\Program Files\WinLaunch\WinLaunch.exe

Filesize
1.7MB

MD5
5103523cc7fdb7031f4dd49e362c8ab5

SHA1
98d097936f785a5257be98075fb4db6fe071d6c0

SHA256
e3c90ecab75d1a49cbc2f20c8a1546fd548578de4538ea166f28575bdedebb4d

SHA512
8a5b8d1c384b7997b866c23e164a643d8d3fdf8d3ec0520bd70837903922370824fe1632e8f9be10770bbcfdc3174f5383017a6befd59f6c38a405f71c929b12

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rainmeter.lnk

Filesize
1KB

MD5
8b673b99a8ccf375f757050be536cdb0

SHA1
014010b36a9c815138898c8872c4c9bfc1b1e73f

SHA256
7914b4df39e963fe7e493f1e7cafa8ea6eb15f7948ff8693f5df3bd01c27e0ef

SHA512
881b10d875e525db0215653438c85957e6fb401df606421dd534954e99940b6cb0d0b8465d3ef14ee92ef912ea16a0f0a027442abbc1ea9045246587605692a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
1890543ec72e2e95ad22ae57df3103de

SHA1
e063be2de16ae67f6c7e8fd6c9d966af23137f3e

SHA256
e1534f9f428f9439fbbea7e0dc6591bd7e6b0733cbb8d3ba1fe05f54340e56f6

SHA512
82b0f3be2ab8fdd447605f9fd60afcbb0ffbcc557af3790f92cb2e5af56ad2e4f9fcc7a6d770301d8a38a7246d35d813fc2e8ca41caae5923a5ba6ff113699bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b3bbc691fdc9603545bb991475e716fb

SHA1
2b0af1cde303b47dbecb5748a1acff39ec1e83a2

SHA256
9b41bb7db122e80972a1d1bc93288832d5670456f5110154512d933f46074426

SHA512
c7c1ab740a2dbba4dabef26d015d9fa8267d1063d28f86af483bb2a2352a23075fc1038c7fcaa7133fbd69068258f0dccdfeb95fa2f7c698691813ebfe833428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b2e071d1d628b03dc1d750e916f8ad6

SHA1
19ec8ccec38122b3a4c1f0716a868410636081fd

SHA256
27949d457a933930aeb80720215d3432739ab82e319b6d075e506c3a4754bc4e

SHA512
2657c9de6389f9ac5350a664da9d281788f63abbf957719d718b91005c42417d0231ea90c2ca7948b1d6517cc704eafcb320e62407bf08e2de0394e759a19698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
56abf27265b84f260f311ddfff75e446

SHA1
18a546b1d04d6744d157460a019310bbad1f0d54

SHA256
69740b4189d38cf6fa2c1a3626d063968fffd53c08c2c8fb7369572b9d5103d7

SHA512
ea26ec7d4b61d3cae7ecb1ecd6e40c68d2a723913298568f052313f2aa362f96ff6510c30768719f81688cf88f30cdbdfbeade67ad3bea3732587fc23d36e0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd35e732a411970e6a32d7742ab71d6f

SHA1
f8b34725d550c4f204087d6b79620260c0938214

SHA256
22c14acd3a61c985ee9130870df47b11ffb96fc20e3b1e313520bcc84602bc71

SHA512
cf1acf84f7a3b96ab950955953bf0cb229d7d0707159f78c967b51c99f86e5e400bc3442ecfd969ce8932d7f2d7879792bcc4a3ac6a4eff73a26984435c1c299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0c65d44bf1d8189e9fff937b9cf09df2

SHA1
60c17e8d698e3e985fea4b32b3f379f14e812302

SHA256
253b65c29e838a1728c760902ff2939e9a4e7ee8ad6b528366ca110aa1c7ff06

SHA512
b7212789d93d14585d2b44212be36c4dda93b0b15732ab56728632cd8e06524f3bab238b03d1db37c56de175fbac1150b522834bf8cbeca62996e968841e95e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1730aebd5d2022f70b993cd8d39607ed

SHA1
ab96a1805a1d4980f3d228c62ac04114aa272b01

SHA256
045e243e7fcf55efa00cd7bf8da6452110f872c568032b301c7ed5527f82f62c

SHA512
c6c8d55d1d7b48c881daa072dc5ed93a1a3c4249e8a70b2e9d5b37c5a00e67bcee5df235b1b26294480546f2d2e3c5abf65e2a242999212fb66429e4012924ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
14a10decfdb859cffad0d5b24cde41c7

SHA1
d5e59728951098fc36f619f7a043bddbbd04fe70

SHA256
62c12b6e95e3f0760bb6167796920f5715f7feb4fd242ffe2a071bbc38d138e2

SHA512
df862d69c46d98f9343da189079009f79f0cc2d0c882fdd8d132a18ada0c3a7dd0bd7a86550d2f9fbb99d1fea29338aae46864c2bca674b0e7f1890543e6e5b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\32f8e602-8948-48d6-a717-ebd51f17748d.down_data

Filesize
126KB

MD5
0a110bd321f114ff8727674eee2a490f

SHA1
ed3eed0bc086ef1df640064d483e20487182a215

SHA256
f1f611b30db0431160b742fb7b8a5ae609a7acbd3724810d92e186c65c14c268

SHA512
3c08d7c95e5bb0fbdf87cce4fbf7cb10db1f2d5df8cc3e8c214ae064d1e0a0bbcdb1d599605a04dd0ab8c0c3fe5401e5a75ee8620d219e4e0da0810693bef728

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
3d57501f44600c5ea7748e701ed50b9c

SHA1
288e4cfc2616ffdfadfb3a2bdcf9e9a70b659c62

SHA256
ff10ffd13b8f191c37ced0229ec0962f0b1bb906e21af18e834bb4f1073247d6

SHA512
f553690b6267f23d49b95e8598d3f5172c70214134d8c5517c588d754f1719f5c3301e23a4643c1d55cf88d8928ce3d3fc9abf66d89713ab745a78f8c165966c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
11456a24b09d7d06cfd68b25c01e329e

SHA1
3b23fc699fd742d4fba3f405b3f90741e843640b

SHA256
8ea319260b55dded20d6137030b5db1bba9a85f7cadb846fe0a4129e51a14838

SHA512
d6225337597e6ee975e02c2cf946be1d066004f5989e38bdb6f0fd646ce6b38cd62c63338d4d3da5fd1166870f7fcd366f3a9782cdc4ab9eaa3085f71a39f001

Download Submit
C:\Users\Admin\AppData\Local\Temp\dat7.tmp

Filesize
111B

MD5
699b288fee6e354d086244f09bfda0bb

SHA1
7d1a95192a67175f5c8758a14fd39bc64d8d1582

SHA256
a671883faefb77095dbff37977cdc31a7d18c2e4a092637305b8994d81b6ed3d

SHA512
a6c28427e1be90ca1ff359b70a64436750eb56830cf624bcc9df020598803286fb7b6f46ce80c4d3141ffdf58c8314f964b7683e5efd9a400e872ff2bdaf45a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq37B2.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq37B2.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq37B2.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq37B2.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk

Filesize
1KB

MD5
08ce8f1223a11455eb14b8a5b8fb67e1

SHA1
79b63a9d1c933f4945541c8cbf55bbe300362dc0

SHA256
1949f088cec22388024343cf98e4836ae47faf4e013db5ca0a4628ad1cc16ff1

SHA512
d0d13c8e248d45bdb927c8f4a7cd19e3c7b6ea99f989d1995da9fdf1feb834bf5a988cbb25749b50c585f5c263b807533864a082f309910193be138f32090795

Download Submit
C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.ini

Filesize
828B

MD5
b01e0c5e180ed70626c4456d9a70a526

SHA1
e0ea07166ac47587cc02011cb792b49458470d6e

SHA256
ba4107f9844b0d4053f48a8a1273774e5a634e3161aa71b5d66d497e05594ffc

SHA512
4affce4002b0d8ea30036f009d6d2a661cf94558a9b2023157258c4d98dde047388dbe90701f8a4a9f29fe269653e851bd24caa3eeccdf6cba28fe341a3c3102

Download Submit
C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.ini

Filesize
876B

MD5
156f060548e6303d9397d0a5e4b6fcd1

SHA1
f91b36f54195fa40952b7190ef50e87b21f3a01b

SHA256
d6738c0e6c7e1c73633f569893853b9f94ae5bc6b9b2802dd20bc6ad5072ff39

SHA512
e75e89cdc9bd845ec586abc51ad82e47f10798df0219ada7cb487e6a5d6f99dfc7b924eba730c23c7b6d604c2e5a1193eb0d658f99a17cd79054d86ea19ae593

Download Submit
C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.stats

Filesize
14B

MD5
8d8fdd288384b581a21484457ac95147

SHA1
d21a34cdf8bb5fa22e4b16ea3918b1a1840c6fe2

SHA256
bbaed1225b640899c768cc23df0e7a356a779f832ac0e2ec91758099a71e467e

SHA512
b94873859a926d50ee5c86e0cb157b248da2fdcca8c28afb1da2fdc75475b8bfd756c14d07d1233fa53eed79822a3684131c3dc6746f622ddcf0e46ebdb1b592

Download Submit
C:\Users\Admin\AppData\Roaming\WinLaunch\ICBackup\Items.637920265470302931.xml

Filesize
3KB

MD5
f26625f0b28b881493bbfc380ab16819

SHA1
153c6cb35fe440f42b610a07901cbbf27bdce015

SHA256
60791c819631481cb4ff468a4d09c9eb5c30f06334327f5ecce703f2f2e1c541

SHA512
e87ca06280f072f0d70f382b7bec6bf119145ca7625b2c1dc48a5df6a4d56d0025afa2868df2b4233aa873600c2e8248bcac74f26dc5c05f50366c804de5fc21

Download Submit
C:\Users\Admin\Documents\Rainmeter\Skins\NR_Yosemite_Menu_Bar\@Resources\Images\Empty\11.png

Filesize
124B

MD5
f8bc9ad54b0f7a700fc9317e8ef572b3

SHA1
6e3837ddb5837cb4da6b3d33f23790d4a996e5a9

SHA256
e7ef95b9949b4ed2b234bb43387b68e0303b69dc40d1042a453216e9b22f93bb

SHA512
909d33115ca8cf8e0f5c717c868670dba2c4ec90b8d22ed81e9209ba8cdb04419183654242085ab6dd5876de6d0b49840060ca12e4bd8bd61000c253297196ba

Download Submit
C:\Users\Admin\Documents\Rainmeter\Skins\NR_Yosemite_Menu_Bar\Menu\Documents\icon13.ico

Filesize
1KB

MD5
147b1aff14fee6b101ad1bb46797d9c2

SHA1
ce4a8a4658945a364e1c86ea4a496888426cedc1

SHA256
e49bd4c371c8ceab78def31e6fe3051568f327c3370d155a40501f563c45db71

SHA512
d5d9bb92fa6ea9150132d3564978e3d7f19912095cddc569da1163650434ba228db55b159c3cbe1007f64465ebeb3ea717a6c0018aa6046734db19c059d44382

Download Submit
C:\Users\Admin\Downloads\Windows to MacOS.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\7z2408-x64.exe

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\Aerial_1.0.5.0.zip

Filesize
334KB

MD5
ac56288791666dc522f6646d4d43a705

SHA1
7c4266c95649a9320d23099988356b2dcf634c91

SHA256
3fa4b63910c7336c7ca40b024bdb294740fe477544e2199d3c182efb26547921

SHA512
9a86bed9e4be2b5c7edde8e87033a63d8ceb15741fa031b7caaebfd631b145c65679d0fef58d6eddd19cf85050176a52b8b749b5292c883ad4d5ae427341a07c

Download Submit
C:\Users\Admin\Downloads\Windows to MacOS\Windows to MacOS\macOS Theme.zip

Filesize
34.8MB

MD5
cb6c26c5a4b70d5640ef0d955db10854

SHA1
3120116fa8e4e5c087e1eef63e54e3a8caab4cf8

SHA256
d560d6030dc7aee3459ff3ac750a42c020d896d33a76029bdc2af61785f82688

SHA512
ff29299ab62d8254def091f55f201cc49f35aa1fcf9d1925a14a36126d26c8a0403a4f268ab8b88a3516d331fe76ecc05ff9a87014477a1d523a392ef341757f

Download Submit
C:\Users\Public\Documents\Winstep\AutoInstall\Leonida3Dthin.zip

Filesize
158KB

MD5
a8db9218d19bcb953b6ee6a2fc8290d6

SHA1
99ba1378c181abfdb99548aef213b5f325eb60bf

SHA256
5320b8f16ee80290387f91f7967d70fe9828dfddb0b346ad28f1103d585f0c70

SHA512
ea82b5394eac1fd4d9b1f090efd35243661dc4769edbe4308219906fcb2a3dc105f970789882fc0b5004ce92ea901fc9fa37a8fa7356084ef64d7b5212d144ba

Download Submit
C:\Users\Public\Documents\Winstep\NeXuS\Backgrounds\SDVZ2\is-GEDGR.tmp

Filesize
49B

MD5
87621fdf2fcabbc69e553758da2753cf

SHA1
5e116eb9598441b6e924b7f320b6142769934fb0

SHA256
bbc092fc23e839ad2e7dc08816f93b6c3c7e8a01e776d31e6c58e5e97c291f4d

SHA512
5d0ff0f032272772e8031aa559eb659969e5b6179dea9e126ac9f9d61d5669eeedda3ae139da5f3dcb806276fa99e29e2afc1b3ab2c87ebd9d90668032e9ebc2

Download Submit
C:\Users\Public\Documents\Winstep\NeXuS\Backgrounds\Zippy_20\White\is-9EFAF.tmp

Filesize
63B

MD5
d790ef81c98f5e58509753663c555450

SHA1
114b312c07d64f3bb51d58a461a79109751df34d

SHA256
1b5fbb364299f161c9a6ee23d64a611492761c9712e349132915b7717cce77f4

SHA512
460ddca2cd01449cc8312ba08816de256b06bb0c1084a2b7ed57c9afb5e01b6da23e44c4b3f07f7c348cb6a47dc5319cfd3dd83188c3fbbc29d83831920ef5d6

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Brisa\WsMailES.png

Filesize
30KB

MD5
0f676bd6e76282fe38c29533d776e9f2

SHA1
3c5d74f3be7562b82083df24e25a14eaf29fbcf1

SHA256
52defb4a068e5d0d3d45cb3f5ec89af4d972d67141b73acb663881d6e3f8503a

SHA512
92e4a8174fc479d11ecdbb1d4f05a72c96c7629fda7cc7df8d51cec13c6389768ec7ffd74f1d2da3f4905f622a8d14ec02a1a351f65fedabc03523793ffe9c2c

Download Submit
C:\Users\Public\Documents\Winstep\Themes\K-TEK4D3\nxtile-mask.png

Filesize
2KB

MD5
34fd6f7149a1056324be0ef13fe49274

SHA1
4499fdb9eebcb9c7fc35658586581d20844f9f8e

SHA256
525de130b6160022da1cc9e2c856a5704e2ace28ba43c663532b2da4ba2348ed

SHA512
f2469925169756d0d924ff55eca87d68894178256fe839191a848a379a985d09bb16307d7f68b1bac1b846501184a291ea1c69aefee9e019b7d2778ec25f308f

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Leonida3Dthin\WsMailFS.png

Filesize
34KB

MD5
996a07d73c05526c2a63208510c09f7f

SHA1
940f83642d6f7595060c66c0cd5c1746be81f5b2

SHA256
02c711312989c335a074e590c8e42fdce138ccab4b44d5f895a8d9b59e9ba2b0

SHA512
29c9e84aadc9cdab3cf8d9d72eb353aea6a442b577533a713d5eb7a52e3c76c8dc8935ad14151263c64d2ec5c082e20f6e8b4e61e00930459679869c5086e74d

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Leonida3Dthin\WsTrashES.png

Filesize
14KB

MD5
deb5ea512d8527daf9e468afc4865ad6

SHA1
485aba500a74e81c978135bca970d7b33b4f2058

SHA256
44d3f2f285bcb65a1217cf979ebbe67f60d8a2a1d7ef9dccbb809a7122515399

SHA512
dbd3167e85c920f31454979745b6d44d22d466698f167939c850e71abb5eb171db9ab79f3ae6dcd02cd5b16a1190137e76ec577983f729b38fcce04cae78859a

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Leonida3Dthin\WsTrashFS.png

Filesize
16KB

MD5
935e0e984b2681fe169d4171340d7104

SHA1
1bba2920f2356fef69b2c85c7eb4133e0bcfbca6

SHA256
be539bfc01cfabdd01a63a845d06cad4e793ab98762453c3576eb8a59bf5759b

SHA512
ce31c1a0c0bf5f9bdf9abfc435ed688cf4f84902f074dc608bbacbf1eea4a3d0f1d8257829c5e31e1b36dfc78c3f0ab316cb346d877549a02566aa2aadb5bc87

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Leopard\WsClockA.png

Filesize
17KB

MD5
20fdec478d7137024468d89471596954

SHA1
acff633dfcf239a5830a58ef8f648444f2c52f8f

SHA256
2fdcb9c592b431ec9ecedb52f9615caef46691af1f01dafaaaee27be29f5acdd

SHA512
81d9938ab34911f95e7b333f124c83294f638c32549b39f0c14f135cb69d4edea6dfcf6d2f02bed4ed109a93d4112beb484843f208314d5a91b2ee117c11f4c6

Download Submit
C:\Users\Public\Documents\Winstep\Themes\Windows10Nx\NxBack.png

Filesize
2KB

MD5
aee5b181348291f672d83920a46c10ae

SHA1
ea930ae7bfcbc447f40003f97525d94a51f9d5b5

SHA256
654aa1bfe39ef3d9a27ef23cc71180220aaf87b0e64a47111a3d74d8f77af21a

SHA512
11b56ed973a0dad8e3381e4def7c3ef178aa2a1360c8f65a563eae85cd0e8a80b60ef112684e88439bfea82db0d4e4d56f4c072ec03abd4fc4fdb8e785d230c2

Download Submit
memory/1188-2115-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1188-2070-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1780-703-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-698-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-702-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-708-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-707-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-706-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-697-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-696-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-705-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/1780-704-0x000002F1D3460000-0x000002F1D3461000-memory.dmp

Filesize
4KB

Download
memory/3312-3282-0x0000020443050000-0x000002044309A000-memory.dmp

Filesize
296KB

Download
memory/3848-3021-0x000001994E010000-0x000001994E1C0000-memory.dmp

Filesize
1.7MB

Download
memory/3848-3114-0x000001996FA70000-0x000001996FA7A000-memory.dmp

Filesize
40KB

Download
memory/3848-3022-0x000001994E5F0000-0x000001994E5FA000-memory.dmp

Filesize
40KB

Download
memory/3848-3023-0x0000019968A10000-0x0000019968B12000-memory.dmp

Filesize
1.0MB

Download
memory/3848-3024-0x0000019968900000-0x0000019968946000-memory.dmp

Filesize
280KB

Download
memory/3848-3025-0x00000199689F0000-0x00000199689F8000-memory.dmp

Filesize
32KB

Download
memory/3848-3026-0x000001996B340000-0x000001996B360000-memory.dmp

Filesize
128KB

Download
memory/3848-3028-0x000001996BA60000-0x000001996BA6E000-memory.dmp

Filesize
56KB

Download
memory/3848-3027-0x000001996BAA0000-0x000001996BAD8000-memory.dmp

Filesize
224KB

Download
memory/3848-3029-0x000001996B380000-0x000001996B388000-memory.dmp

Filesize
32KB

Download
memory/3848-3031-0x000001996BCE0000-0x000001996BCEA000-memory.dmp

Filesize
40KB

Download
memory/3848-3108-0x000001996FA10000-0x000001996FA1A000-memory.dmp

Filesize
40KB

Download
memory/3848-3107-0x000001996FA00000-0x000001996FA0A000-memory.dmp

Filesize
40KB

Download
memory/3848-3106-0x000001996F9F0000-0x000001996F9FA000-memory.dmp

Filesize
40KB

Download
memory/3848-3109-0x000001996FA20000-0x000001996FA2A000-memory.dmp

Filesize
40KB

Download
memory/3848-3198-0x000001996FE50000-0x000001996FE62000-memory.dmp

Filesize
72KB

Download
memory/3848-3113-0x000001996FA60000-0x000001996FA6A000-memory.dmp

Filesize
40KB

Download
memory/3848-3112-0x000001996FA50000-0x000001996FA5A000-memory.dmp

Filesize
40KB

Download
memory/3848-3111-0x000001996FA40000-0x000001996FA4A000-memory.dmp

Filesize
40KB

Download
memory/3848-3110-0x000001996FA30000-0x000001996FA3A000-memory.dmp

Filesize
40KB

Download
memory/3848-3116-0x000001996FA90000-0x000001996FA9A000-memory.dmp

Filesize
40KB

Download
memory/3848-3118-0x000001996FAB0000-0x000001996FABA000-memory.dmp

Filesize
40KB

Download
memory/3848-3119-0x000001996FAC0000-0x000001996FACA000-memory.dmp

Filesize
40KB

Download
memory/3848-3117-0x000001996FAA0000-0x000001996FAAA000-memory.dmp

Filesize
40KB

Download
memory/3848-3115-0x000001996FA80000-0x000001996FA8A000-memory.dmp

Filesize
40KB

Download
memory/3848-3121-0x000001996FF20000-0x000001997001A000-memory.dmp

Filesize
1000KB

Download
memory/3848-3120-0x000001996FAD0000-0x000001996FADA000-memory.dmp

Filesize
40KB

Download
memory/3848-3122-0x000001996DAE0000-0x000001996DAEA000-memory.dmp

Filesize
40KB

Download
memory/4892-2116-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4892-2061-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4892-1132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download