f0ccfcbe9cb32247328ff872632e6a9973d5cb9b18af413d78b98372e5f7b279

Analysis

max time kernel
1761s
max time network
1765s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

url[1].html
Size

1KB
MD5

9239658a5a3142c4512ebcb51e05c7bc
SHA1

b1fb06c545ceaff19bd5018be7ee41eef4da1020
SHA256

f0ccfcbe9cb32247328ff872632e6a9973d5cb9b18af413d78b98372e5f7b279
SHA512

330d8e9da02caa61b9d27c8f000111a787e887638e38bf40b3dd086a37d0105a12695c48ed583e827bd12ec51e86f95fbdcabc76020a5e3256a3ca8ec5523c09

Score

8^/10

microsoft discovery persistence phishing privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: EA76ADE95776D2EC7F000101@AdobeOrg
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	GamingRepair.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4048	MinecraftInstaller.exe
1596	MinecraftInstaller.exe
3716	MinecraftInstaller.exe
3676	GamingRepair.exe
5972	GamingRepair.exe

Loads dropped DLL 1 IoCs

pid	Process
4392	Process not Found

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GamingRepair.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b49e84d-af4e-ac4a-b2e4-3545861ec15a}	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingservicesproxy_6.dll	GamingServices.exe
File created	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{518af95a-4b2a-c349-9c5b-01ff76bafde5}\SET4DA.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5359.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.cat	DrvInst.exe
File created	C:\Windows\system32\gamingservicesproxy_6.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{950ba7c6-f9e3-3948-9e74-758b76818034}\xvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c89f2635-8943-f848-9fe4-15c04d7442b6}\SET890C.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f4c5cc66-ae55-294d-9717-18e11f6dccd6}\gameflt.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b49e84d-af4e-ac4a-b2e4-3545861ec15a}\SETB2F4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f4c5cc66-ae55-294d-9717-18e11f6dccd6}\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamehelper.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b49e84d-af4e-ac4a-b2e4-3545861ec15a}\SETB2F5.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\Temp\{b8d8f487-a6a9-f241-846a-c0f00462d865}\SET5B4B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{541322a5-41d3-364c-9d68-40a2dcfd3e28}\SET322F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7e70c3c-2d44-9744-8287-bca505ed0294}\SET6A6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5358.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{541322a5-41d3-364c-9d68-40a2dcfd3e28}\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingtcuihelpers.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\Temp\{c89f2635-8943-f848-9fe4-15c04d7442b6}\SET890D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{950ba7c6-f9e3-3948-9e74-758b76818034}\SET4F8F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gameconfighelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\gamelaunchhelper.dll	GamingServices.exe
File opened for modification	C:\Windows\system32\xgamecontrol.exe	GamingServices.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\xgameruntime.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5338.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\gamingservicesproxy_6.dll	GamingServices.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GamingServices.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.pnf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GamingServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	GamingServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	pnputil.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GamingRepair.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GamingRepair.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	GamingRepair.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C00F532C4342 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000009e83f37db5345044a782d4ac8afa0ee600000000020000000000106600000001000020000000e9ebce9d26ca504d0fbaa69cce3bd3d58988a0ab075e0bbc4573b11a245bd584000000000e8000000002000020000000b74624dec148ea9887b5bc67ac59d80677219ab0de19406220b6a78664d4df93800000001b26f82f3f1934e567c23fdc4b3082b5fd84544e03f2b618696020d02b5a273638da396cec3f3ac6664dc9b0b01b030a16505aac7b1d506a3a306af0c959ee7bc3704e75aaf7c614376acecbccd237408894325bc2edf3f19a24172c0c972008825cb7aef395f1993be8194ec6e785effd1b1467bdcdc3e644218485749fbcc0400000003437d7cd8d88a0343605c88a9c0e7653da5deef421dd924e5b73faa7383aafa1fb609bdee71d4db28c97be852eedb36baaeb9dbbb91b891cff65209eeb172d8c	GamingServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7D04FC0-0721-41BC-B0BA-336A52801B73}\ = "GamePlatformModControlService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{090795DB-989B-4625-B397-083D85066042}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8c287778-d681-5cc4-8b71-7beb22a83c21}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B505C36-F289-43C1-8739-2D9E89B05533}\ = "IGamePlatformIdentityService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2fefca8f-a720-4b55-8f61-29295da1c93a}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4DAB5B8-A025-4A72-84AC-7FE45C6E5456}\SynchronousInterface	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4D2BF08-1409-4918-9D84-32EE00E9178C}\SynchronousInterface	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ce4ed0e-055e-4818-aa61-37d734d093b7}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6593254-0EA2-4938-8D62-7B353395126A}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573F62-4649-4424-9978-ADB20C1AAF14}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36366C1F-B5FF-42B3-A4E8-03DD891A56CC}\ = "IGamePlatformXRuntimeClient"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44564d39-2e0e-46c5-acd4-c24260c440f6}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{834366DA-2D43-4FE3-8DCD-42FF2274BD0D}\ = "GameCoreTelemetryService"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{710318A4-861A-4599-9DA2-50C84EE59ED8}\ = "XGameSaveService"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29EF372A-D438-4FAF-A173-8E109B0F675E}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63b4e0e5-78f0-4621-bb03-3f773906b2fd}\ = "IAddUserResult2"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{e67d6fbc-a1cf-56c1-b374-9043bc3c5c58}\ = "Windows.Foundation.AsyncOperationCompletedHandler`1<GameCore.Users.GetUserTokenAndSignatureResult>"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F91D5C6A-FA6F-4F37-A6CF-B38C4C1ADDFC}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{cdb752d7-f11c-5c86-bb08-a2d43c56e6a9}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7DF268C-D6FE-465F-AB23-DDD1416E7C6D}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A35C28-08C9-4805-9E85-D7ED759314F9}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0796012e-ba5d-43f2-add1-b2aacf6e0eda}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c4ffeb73-c9fc-44f1-930b-ad0254e8270f}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E8C9ABE-9226-4609-BF5B-60288A391DEE}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2964DB41-BAE4-4996-A0A0-D036BFFDC267}\ = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C8ADF3-BBC4-46B2-BD96-E9105D203438}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{862A26A8-2D87-4D8E-8E6B-17DB48B8234D}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66E7F310-E333-40EC-98C3-E4E22C945505}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9A0294D-7E6C-4129-BC61-B37EA9CC3417}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8B9BA5-D030-44F8-819E-EA04BE3CC9C8}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81a071a8-08cb-59f3-ade7-8ce0499458f4}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A68968E-D3CF-440F-9DE5-75E5F4C11236}\ = "IEnumHSTRING"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1DB77A7-71B0-41EE-8CC9-7B820260027E}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7B40E4A-FB25-4648-85CF-8873178D7DA4}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2613EFFE-657E-4FCF-97F2-43EFAC856D92}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6AF7-8620-4B0E-A9B1-4CA958B8A24D}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A9D8E03-A524-4FC6-A566-2BC802898DFF}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66E7F310-E333-40EC-98C3-E4E22C945505}\ = "IGameWnfClient"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8B9BA5-D030-44F8-819E-EA04BE3CC9C8}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{465caef2-e60a-575a-9169-39a55c281d75}\ProxyStubClsid32	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D87D2D74-150C-4498-875F-3FA375B079AE}\ = "IXboxDesktopDevelopmentPackageManager"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{317A3652-D93F-4921-BEBD-F7AAABF32569}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81a071a8-08cb-59f3-ade7-8ce0499458f4}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FACCFDC4-ED66-4EFF-8F00-AA1374E4499D}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13A35C28-08C9-4805-9E85-D7ED759314F9}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B505C36-F289-43C1-8739-2D9E89B05533}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7685A31F-F733-4246-8547-3DF85BB717A2}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05BE69B0-B0CD-4DDF-B3F4-735165435D93}\AppId = "{2964DB41-BAE4-4996-A0A0-D036BFFDC267}"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB48C4B7-2ADA-438F-A9CA-E6ACC3838C4B}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87044ed6-fa31-4be8-b8d5-b181c7210351}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{276d243c-db6c-47e9-8e21-ae51d4c3dfd4}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C8ADF3-BBC4-46B2-BD96-E9105D203438}\ = "IUsersClientWindows"	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5ae6bb57-7a69-5e73-8a8e-48f32b08cc3f}\ProxyStubClsid32\ = "{E2EC1157-5248-4559-B741-EB7C6DD48EB4}"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC042A88-E160-44CD-B089-8C9E6F0AB42D}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9291ed54-b88c-556f-b870-49a901ac529d}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1d14199e-b717-4698-bb7d-1e994723f680}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{b2d57aa0-8729-5ab5-9e6b-95059b8d8a94}	GamingServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F87250D-063D-4871-9399-3A603DFA0E04}\LocalService = "GamingServices"	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8040B92-21EA-48C3-882B-45B69FF04AF4}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F91D5C6A-FA6F-4F37-A6CF-B38C4C1ADDFC}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9040DF33-5862-4B1F-872A-2FB54951A60E}\ProxyStubClsid32	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E118543-2CA9-49D9-80F4-255B76E3D84E}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5d3910a4-74e0-4cf1-bfad-50b1c6522cfa}	GamingServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F187A451-AC81-4283-935D-2A2C4797D3D6}\ProxyStubClsid32	GamingServices.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 294312.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
2376	msedge.exe
2376	msedge.exe
116	identity_helper.exe
116	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
4224	msedge.exe
4224	msedge.exe
5952	sdiagnhost.exe
5952	sdiagnhost.exe
6068	GamingServices.exe
6068	GamingServices.exe
5880	GamingServices.exe
5880	GamingServices.exe
4556	GamingServices.exe
4556	GamingServices.exe
3532	GamingServices.exe
3532	GamingServices.exe
404	GamingServices.exe
404	GamingServices.exe
5636	GamingServices.exe
5636	GamingServices.exe
4580	GamingServices.exe
4580	GamingServices.exe
976	GamingServices.exe
976	GamingServices.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: 33	4536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4536	AUDIODG.EXE
Token: SeDebugPrivilege	4048	MinecraftInstaller.exe
Token: SeSecurityPrivilege	5996	wevtutil.exe
Token: SeBackupPrivilege	5996	wevtutil.exe
Token: SeSecurityPrivilege	6112	wevtutil.exe
Token: SeBackupPrivilege	6112	wevtutil.exe
Token: SeDebugPrivilege	5952	sdiagnhost.exe
Token: SeSecurityPrivilege	4656	wevtutil.exe
Token: SeBackupPrivilege	4656	wevtutil.exe
Token: SeSecurityPrivilege	820	wevtutil.exe
Token: SeBackupPrivilege	820	wevtutil.exe
Token: SeAuditPrivilege	3464	svchost.exe
Token: SeSecurityPrivilege	3464	svchost.exe
Token: SeLoadDriverPrivilege	5736	DrvInst.exe
Token: SeLoadDriverPrivilege	5736	DrvInst.exe
Token: SeLoadDriverPrivilege	5736	DrvInst.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
3624	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 448	2376	msedge.exe	82
PID 2376 wrote to memory of 448	2376	msedge.exe	82
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 2408	2376	msedge.exe	83
PID 2376 wrote to memory of 4476	2376	msedge.exe	84
PID 2376 wrote to memory of 4476	2376	msedge.exe	84
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85
PID 2376 wrote to memory of 3280	2376	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\url[1].html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dee146f8,0x7ff8dee14708,0x7ff8dee14718
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6496 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,7720365607481334944,5420415757939060081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks system information in the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3676
  - - C:\Windows\system32\msdt.exe
      "C:\Windows\system32\msdt.exe" /id WindowsUpdateDiagnostic /skip TRUE
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:3624
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5996
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6112
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4656
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppModel-Runtime/Admin C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppModel-Runtime_Admin.evtx /ow:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:820
  - - C:\Windows\system32\wscollect.exe
      "C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
      4⤵
      PID:3520
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y
        5⤵
        
        PID:1336
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y
        5⤵
        
        PID:676
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y
      4⤵
      PID:5148
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y
      4⤵
      PID:5432
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_AppModel.reg /y
      4⤵
      PID:5360
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_AppModel.reg /y
      4⤵
      PID:5296
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_Appx.reg /y
      4⤵
      PID:5228
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\ActivatableClasses\Package" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg /y
      4⤵
      PID:5484
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_WuPolicy.reg /y
      4⤵
      PID:5556
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y
      4⤵
      PID:5620
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y
      4⤵
      PID:5668
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameFlt" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y
      4⤵
      PID:5708
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\Xvdd" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y
      4⤵
      PID:5756
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg /y
      4⤵
      PID:5800
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblGameSave_Service.reg /y
      4⤵
      PID:5868
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameInput Service" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameInput_Service.reg /y
      4⤵
      PID:5932
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\DoSvc" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\DoSvc_Service.reg /y
      4⤵
      PID:6084
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\InstallService" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\InstallService_Service.reg /y
      4⤵
      PID:6112
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wuauserv_Service.reg /y
      4⤵
      PID:1644
- - C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
    "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5972
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1596
- C:\Users\Admin\Downloads\MinecraftInstaller.exe
  "C:\Users\Admin\Downloads\MinecraftInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x90 0x3a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5952

C:\Windows\system32\svchost.exe
"svchost.exe"
1⤵
PID:3292

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6068
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4632
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:5544

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
1⤵
PID:3712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3464
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{ce4fd2b9-8ec9-9a45-8b69-2d843c2a7edc}\xvdd.inf" "9" "4d4de4ae7" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:324
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5736
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{7178a233-b881-d544-a8ce-7d6f2b8673d1}\gameflt.inf" "9" "403791c33" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000164" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:2876
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:1308
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{27b10654-d969-6341-86aa-2f6b3b59d21d}\gameflt.inf" "9" "403791c33" "0000000000000104" "Service-0x0-3e7$\Default" "0000000000000170" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5544
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000170" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:5892
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "0000000000000144" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:3676
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{52552ffa-f49a-b740-be8e-efa2fde2c92f}\gameflt.inf" "9" "403791c33" "0000000000000170" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2344
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000160" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:4316
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5248
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{00c27a9e-8f2a-4143-8374-712400168945}\gameflt.inf" "9" "403791c33" "000000000000014C" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "000000000000017C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:5660
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "000000000000014C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:1920
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{81c83fd1-717f-1141-a08d-a378961f9d69}\gameflt.inf" "9" "403791c33" "0000000000000188" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000184" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:4220
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "0000000000000190" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5472
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{4b62ed9b-9460-1745-9a99-401cfa7bf1c1}\gameflt.inf" "9" "403791c33" "0000000000000180" "Service-0x0-3e7$\Default" "0000000000000190" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:60
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000190" "Service-0x0-3e7$\Default"
  2⤵
  PID:2300
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "000000000000018C" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5992
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{f045d124-722c-7f4a-94c0-7ed3649076de}\gameflt.inf" "9" "403791c33" "0000000000000180" "Service-0x0-3e7$\Default" "0000000000000190" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000190" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:1340
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "00000000000001A0" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5448
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{2dcbc185-bc5a-764a-acca-d83b9d381c3d}\gameflt.inf" "9" "403791c33" "0000000000000190" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\drivers"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "403791c33" "0000000000000184" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in Windows directory
  PID:5776
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_152b7ad8bf20bdc5\gameflt.inf" "0" "4b9547ee7" "0000000000000198" "Service-0x0-3e7$\Default"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3928

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5880
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4584
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5992

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4556
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:3344
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3940

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3532
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:5952
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:5048

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:404
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:1200
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:976

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5636
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:1228
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Checks SCSI registry key(s)
  PID:4584

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4580
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:4516
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5392

C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe
"C:\Program Files\WindowsApps\Microsoft.GamingServices_26.95.25001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:976
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /enum-drivers
  2⤵
  PID:988
- C:\Windows\System32\pnputil.exe
  C:\Windows\System32\pnputil.exe /delete-driver oem4.inf /force
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\BITSDiagnostic.debugreport.xml

Filesize
1KB

MD5
e7b6279dd7cbf834ef042e1bdc0bc9f2

SHA1
4f628a80d1c5020e997c3ce4be284265351448a1

SHA256
37ff4330cd67302d2b310f02558e45dcddc0d3e4a5fa931cc342ab8f8dcb9cda

SHA512
7c6fc6b23fb7700a29790446708766ef976d346253508d4ca8c9cff69b1ecefe28f9c314befd341ef0ee11c219113c1adc9e522e0ea2b8eda4f9fbb5007d3ea3

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\NetworkDiagnostics.debugreport.xml

Filesize
1KB

MD5
c0552f56da896241b84020aa557bb215

SHA1
22ffdd7bef14dcfcd86fa7ab366e73fc31c5c1a6

SHA256
cddc52a8941ba2b162c0331ff9814cbcfd357b72ce24b582f26c09c7bb76073c

SHA512
e643a3e40795d103d22a6c723cb199764ea4329ce3f90db3da7d9f8a854acad1c5f9b25e83770bf383a55e9949050470ae1984fed845840404494d589116d433

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\ResultReport.xml

Filesize
5KB

MD5
08dc29e104c368a7dd8dfd250d8e1249

SHA1
6513c14a5be63dffd85c1ca71bbff8d45424751b

SHA256
87dd9a2a47014d479b3713d596221b2f4244980d2d326b728de0211612bd0cdc

SHA512
6758f9f650d6d39c5d73aa7b9fe234826ac3e721cfbbf82106d7fe2243e074eb8a6504d81b09290592b272f1872d2e5fc7c708131280e3aedb6c6f8ee6b7849a

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\ResultReport.xml

Filesize
2KB

MD5
d3d2f141d84c521a61eb8d34815ba7eb

SHA1
77cf6c0c70a2747775d3886ccd56101b5657dfc1

SHA256
a86ea2c0cea6cd8b8e142f1017e690c50f9374c3138e8260df40da17ec1686cd

SHA512
30790447e82803d2d9876d923abf549d4ab9fa0870c7c50df2228a9c2d6557d6c6134bb3e0356ea3f3f131a68905732d1b19dc08835e1f25500f24b2cb3b5d35

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\ResultReport.xml

Filesize
36KB

MD5
dde398cc56f0a8409142093f3f782d0d

SHA1
a0a6d555b2d2ac36074e5dbba8b1a6f325e6d0af

SHA256
bea8d9c2eeafcc3942c4073759b01dc25a1d73dfa0300f03dc09e60f9b2d1e45

SHA512
54085a8411244b8971ad90c2532baffa195384217730133faa74b5a58041ba9da63019287d136178aabe733a0f555c5671524bbb691d274b798461bfeb6b481c

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\WindowsUpdateDiagnostic.debugreport.xml

Filesize
1KB

MD5
76383a21ad8c59ab3c974b54ce5510ec

SHA1
c7412fff8da9eb9fe31febf35d894d8ff2e90649

SHA256
923dd26c871d3bf8502676640fd240511eecef2084b77d0d7d0f5265f29da04c

SHA512
b6e7d697fe0d48493eef2d8b64a931c5391424711ab078d8445d2805e3a82e1850e9015e69adc711ee440fe0d7676c4342ebdecaf40e2111f84882d6d2ec6479

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\2560293460\2024120413.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MinecraftInstaller.exe.log

Filesize
1KB

MD5
e57a6e70b8ae6940ed761121e5f86bad

SHA1
aa080336f2f6fd47ba55b7d9b5ff21ec27c665a2

SHA256
3f9e9790ecc228887f345c8cc495b550487c345c2ddb63aa8d81f45d02741f44

SHA512
16dc9d8b849f4a330e81fc8dfbfdc29823fb9fee7983bd9de7b936d14ccf94561b6697d67c237fc11d9720ad212b7c3b34b37921eb50fe315ee1b9678f058d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
17KB

MD5
e2cd9e637846b31157e2880406f7ccd1

SHA1
e4faf9d793a651d0d8d1fbdd34da280385c2e987

SHA256
6b4aa2b8b9a201561a94166817a08d84db2226b69b57a5797e40e19466825fb9

SHA512
78a91f19cd07f8f907420e09a387d7a672c78ee655b8ef272fff3ef4973974735ddea1f2c17c03cb90ac2d254a57237320156c94082c8f1a0288167162b1bbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
79KB

MD5
113244e49dc7bb01febd4e77636ccfb2

SHA1
f5391495e9ecf4673f6b0caf275dec436be0a500

SHA256
311fafd0148430e464c9e1d21acebbbffaa06911b01ab19ee42c41c0ef75fcc4

SHA512
f6ce78022024a036fb445b856c7e503131f984da8673911245b06eddccc1aeb1914e92ed08f32f30edc68b5514df647d704b0bec665780d81a305b4fc0572070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
100KB

MD5
66d0d77404b618e3f1f1302707b1f4d8

SHA1
118e8ee6fe6b132740f51682c38bb28f7e8f2c6e

SHA256
111ebb096288f6e3cce23731116a787353316053085957c040c543603a71c644

SHA512
00776cd39808c5fc9a7e6011ec74dfc29266af4ab4225727c130d8ff11d139bc17c9670bd87b089284359abe560d3d98e46a43156a763f47f457168097f872df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
18KB

MD5
3e9d803a289d8e076db4ac7e3fbafef2

SHA1
a97bb8ab526e743d6be3ae66e80b023494d4760b

SHA256
c836ff2a9c963ba37d16b9ca7c6bfc75755983a1ad89d028f804ab096b91c760

SHA512
ef5e221832d6026281990473ccd21e320fb7322ff748e757a271c508ea48471ca428287ad0488c5a389a28480310649fc88bbab192234f61853effb085fcbb68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
142KB

MD5
2c5e11f246da43cc25ca9cacc9504290

SHA1
5c7de88e00c567f397590d5ddb9b8ece00cce459

SHA256
c130f5e41905d2ac94a193188530346a428bb5dce2d63b73da56af1a4fad12a5

SHA512
4c52e1db4ad11077ba6b05a348d3bf0ed1633742e93a49901fc43d3b9f67a6554b2cd2c1cccd93eabb1e6d56fcfbeed9a5f5e448070585b3ebdda2a4c8f7e957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
075a8ff8ed2f729a1e0eb4b4151c5187

SHA1
b0c68b3003d9489f4e88b317679b469bd200a20f

SHA256
b413d68fcbf335ca708a1658cbcb85e441e708dab8db75737129071dffc5bb73

SHA512
1c589b0115509d2787de5fae1f04cb673dded33d1a700bd8d8db17d98fdfbec8c05e668c3519fe0af6b5017291a456a7e2323f0c317fed30dcd9e827a7ea2609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
20KB

MD5
38651e7691c50cd2ca68b217544008ea

SHA1
bcd0626b48ebf72b3a09f6a4df58c58be8465e6f

SHA256
9d61fe54275108f008fbaab2ce9747f85a18986099d4bb72443b71fb2d6970f8

SHA512
eaf676e3511a910886d46ad225f9c5f527f7a5aa8fd73a8fa2dcdaeab6c2375386bef0b50c937fa2d25b3af67575b210dde0dce4c03c3e63372144772e8f14bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
60KB

MD5
af731e6b35f48e3c0ed6c41bfbe29ee0

SHA1
a40bff10958b972bedfe926f7d33601a6007a623

SHA256
9bc4a857c12af417583fce5014bbda16333a58eea6062494979275e9c16b17bd

SHA512
b31f9124204b97c16dd23eeabc234fec5adf7f15ee684333651c364e911ed0bbdc126044a95bec3dd9426f3c4c6528aa70f2dd192625e703cf7b6ef2ed35bea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
37KB

MD5
21038d564ede780307214b8f23cfbd74

SHA1
fd663b4fd71d6e0abe19f422e5e4ea6696c23699

SHA256
347cd91f624a9e7cc3e1d145577398bf2a855f25b29c87e68794bdb04c6fa3b4

SHA512
dfda651e92b33be25eddee9eee017bde3248d2d9e2253e1a80818bb8a7ae33d0f35db1a4f5b9f170c7f8fb4bd15fe2347ca714aa87a81f6140b9139a39169694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
30KB

MD5
b8a23e0dab360d945330153a7a3d492f

SHA1
5def360c92e333db174f6dc27a28a4330fccc0bf

SHA256
1b1e71b40d8e6efff7f051770c9df6bc279fff7958c0b90facca71205d530a16

SHA512
ad123b2738db1556da2f3e066b4cd19ef0737e2f82486042437927eab9ba454a6211c064320c7ee3028da40045201ef7cc7b9d5bee330a8fc74e0c1cdef70aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
61KB

MD5
2078c2e327cc2f34fed6f2d36f846a3c

SHA1
57b8291b5002ff448bf97e30c325c6c226cf05fc

SHA256
fe53924d5a1cfc556f3edc6cdf417fa2e203658229573725bfe6e58b9a1746ec

SHA512
fe81fe890f6690611719cdcb0c0c07d8413f1ff8f3666c49ed359e94a22decc676c03ae482155d3d014144c7e78b84feaeceabb044fe6ff85deefcbd769149de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
33KB

MD5
094ba2b66d9a3efe7099a07e7bd5007a

SHA1
2cb33b0a3aa79e56cda89893a00210a97e34df93

SHA256
828b7c72f17a5d288c7d6005db65a9534ef19a7fc37670bc18438125d8db8242

SHA512
c09dde8b5880bc68b501d13c06f11ab8146363d05abc7af7658e09d5f94cbc0c67bf86de0287004fccae3becf425fc39944396dc82c110b411fa8268f3551ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
33KB

MD5
79e17d2a709ad15dd72088ce652ceab4

SHA1
aa6b80c9615999f817bd232ce198e06351b16cbd

SHA256
9769f5cb626a0d8262f2f581e406cb3cf3c0d5767fa53efe48e4f63c4e4f79d2

SHA512
e5f3c020c0af5acaafbad1f009c210fb6fa2c26625e6b07ae2660ba115bcdfaadaf00662e10e5ab3ff83490b8afdca9c146ef4e09b7bf2b9525054f52e49638b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
38KB

MD5
387b4554338078b33c7d5303a10f7cb5

SHA1
24076866991422bd3a9f0eba076ff99e67071514

SHA256
2c23487e4ffcbf90c765a504976d0380939cf5fe19c04ee5ae78b25a74c7beb5

SHA512
08327138dadc086218bce7f3e41d1fa43047bc2ed0a0cb54e1be323cd7b9b93869088ba1ecb7ceba9b7cd01449be4785aaf90553a8aff973a6e25875205dd311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
22KB

MD5
eb4990aae4bf3586a9458699b94525ad

SHA1
3f164401247b8996100d0c0433408153ae5effd7

SHA256
66139c3283025a5b253be1c6a6ebc4a1a068bee65fcbc05c4938784cab257d85

SHA512
36220a960dae5d938e42961ee565a18f1eb3dcad85710d859015c4ff3a22f18ed35853efadfedd1ab3a7058b6c8ecfd5bfea7381406a6f31fa04652432f2f2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
21KB

MD5
940f9355a42547e0de097da7743b1ec6

SHA1
19b90f4c61942a7e4eac3c7f818656ffba78e5aa

SHA256
b1c604ac388f6da09c414d3d5d4dd52f46096138930c47928db4a2dadb8fbaf9

SHA512
e84cf718862f1d0bc3aed62fb2cd7598e739a7fb08035adeedb163b49b24fc65fc7018c412c8d5505d2e95fd12a328e30aa52475b9a749ff916e256b5e0f6e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
45KB

MD5
af76af975802b90f9cc45103d8ff1695

SHA1
f6e82f99fde5ceefc2739875ccca6816a0778456

SHA256
2bffadfd7f6dce9b812cab592e62141fdd7fcfd5078694d18a971ce353ebb1b0

SHA512
cd08025cf4093786367a9dd99539e95e9f7ffd1d9146fa60b3b1f8ba557fa55cd306a071e39e1ad1fc7284070ff9afc1602fa01368f2a5cb6ce7fb5033472918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
27KB

MD5
11745a5439d8dd9050e3090c3a087750

SHA1
49098a30587310d94e3b92896c282505a8ecf7ca

SHA256
7768832c0a0ba894d1a60b8259d5d5b79eebfa5a3f6ae93159cededc027c0752

SHA512
c273b0488b6257ba2d153086e4092f8afcd3a7e30a487ddebb1972e5614bd0885e56833d62f1aafa7ff968e25140ecdd0ef8fd40f3e458a95fdc156757b17451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
18KB

MD5
4bf6b00f2274ad0ee130137d7d096fa9

SHA1
e8d59cb49478e1115132bf6466dfcb59f1e87cf4

SHA256
94a545a84b94950c78ff120428669d0b0459ad310f4a6c4efbd83c7845e346d7

SHA512
bdaba4a29aee3ec82171984206a36135c555c11a4f2d2fa226c06a9817a6532cb49bc4de1fd79b5edf6d8729eef9ff4949b6a6ef4484f3169bf06687ee10adb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
33KB

MD5
18c5f73d2beb519c4208dc9b9b0e33a4

SHA1
117d528f3b25c8d43ba428f8d776f8a38d921748

SHA256
b10c958bd33d0332130fe918c9460333d57b728b781a4ecfb89f3972af5ef33b

SHA512
027a704a892cf2d4373a1bc3afa45b586a6b1defc12acb680c06456f7fcee9d716cd25224148f7019ffcb9b8fe220677f2f010031a5871a426cae2dd6255c402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
31KB

MD5
f0b564c7e16adb23e5348b6ec10f203f

SHA1
40acfc68dfb158d0b986be00e87986be94dff5d5

SHA256
92f7430ea1ecba95c53329250e13c1306351aacd4a4307f0dc87ceeb8b2a0df3

SHA512
74eabd1b9fbeb6df277c9f2d4a302b09c4d495bab3e3a854d03a1aa40fb3d997b116cc820c76e55610aa3455b724ad14aeff2c44a756c265e5dc342d8d59dfe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
74KB

MD5
b26ee67ddf2303f29e25e823aac59d87

SHA1
c6cf63de909d0877b6f0c1d7a9b905ecee05148b

SHA256
ccda3c450b6a961986ce784d5d2b058e0f98e4dcc536fe0fd25fcc2b02f5c834

SHA512
0cf8f16898d204ff8aa47e2677b5389c1935a7f4aaede6e68f7ccb41cc50b8b8438f27dc315e387118f809381a0b012e27f54b013908c4898b76c0323ee3fc6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
116KB

MD5
764ab665760f4d225a56d1d14ea90b8b

SHA1
3265acc8ac2b1311967d1f9706b84ba60bc82861

SHA256
77fd3c63465f6ad86136656784226e833790eadbebed0c0c9243676b040f6184

SHA512
b6c333a2fe7f5b5692e0628db26e6d33ba77946490d1eea62120950503529b68dae045213c3daced8361b6e7fbd22ebba32abaefaa82e8ef5f02f7a17b21cb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
78KB

MD5
02377c57b4eaa72a86846f9ddbe336f2

SHA1
610c414741d363002e717b86a71d830176efcf3e

SHA256
fa717e40de64bf72ffc9f4f32319113bc42e2f13992ef02ed98209902a8ff4ef

SHA512
cad15382393ac731b1708851c72510974064d25cd9b54ecb72b7045f6f22e0c15257bac94f75253fe9d6e6b002529d2e250a1685eb1951083674589084bc0557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
46KB

MD5
c7999bddf49dc59e5dc70e24a93335d4

SHA1
800def2981adc94b43266eafe7d63da87177233a

SHA256
88e0d7bf8746ee4059c96413bb6f6df20ff8926ae3cb344f62a328bc589a2382

SHA512
c9c993e6d22f88fc8a2052b40145176600dca3031c093cf26c17560b27b181d8814e702000638e931798eb05b5741e5594dd251ae9c322d9e7483994b3beb6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
55KB

MD5
a2b439602ef1e64d60e65ffc94970652

SHA1
03d489e27026175c6286f0f64ad43f97ecd4d2d2

SHA256
38a8dc7f9033b0b5925db70cefe90adb544096c07a9e6486da3f18ed8b18dbae

SHA512
b5658d589d081e3da21266b63e3b47dfe8e6d5dde1bd6dff85186a9aca9bf09e2cd496e9a295cf6cfab8b71f6df0846fba9053690d8ed4e3a470257bffa9ee3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
200KB

MD5
7ad719ae525ff1b267c7ea1e510d48a3

SHA1
6305521e7e1a1d7a815d87c186e3d3041dabb7f4

SHA256
29e53adae4feb17cf9eac22c68d30a607c9bb16c4208957341113c7749ac5df1

SHA512
67f3d54fd2ff40afdd188708ed1a2be6fc6ed8c7f4a15e327e6f906d48a401d60bff23319acd966d0ba0470a4e94938dc9fb38044f5980e67ecf5f1354b9dba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
65KB

MD5
24d9406038f994531f987fccc974ee86

SHA1
185aac4f11b8f8ae0d522d8e2d7411367499895a

SHA256
4d8395220f86390e6c4d86e26a524682152b902224b324355486c8b248f1574d

SHA512
3df61f3abc76a170034cae9dd0972c5faf6ff3b0437acfafcbd2a3558100e37f79542b87c5d7bde6c5c6c7e4901609dc7ee780fbafccf9ddb78f84f5a2a20aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
20KB

MD5
e509304e6b90ea4ca2c7a603782a8bcc

SHA1
3a28b091ef885b3de68820bf01b1e81f9df7b5ff

SHA256
7d91b7062bc1d4d4352be1562345a5bcd3b37fee59bb1514931eca3770041fbe

SHA512
21df3cf20bbdeb2948a751085d0b7ca1d0fddfc68bf8e855176394a6f9def06ec1a7b6362a54acabb2b9f3a37b013ae2a6c038d06279794c7ba9a0957adb7ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
164KB

MD5
a233c97f114a902a8609511b1e61c7b6

SHA1
767e6cef714469d560e7240f5eecbd953d2ca349

SHA256
73e8373fac6bf858369aed650b133e6307290790e10d67ff3f676d201100be49

SHA512
adaadaaeeddaec6f4fed560ed701e6a2240fedf81c395f30e19ec23ccb27a87c6af4af28b83cb9af911f66b516dffe6eec63605b3d19f975fbd84196c8c1f35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
167KB

MD5
a7fb09ab154941825d7d210b6158f07b

SHA1
7ed366bca1e4e6b3b8dd3e4aa2040f9ea32fa094

SHA256
e6af90168fbcde75914010f27cd5255d1afe076790249fa48970cb3b2002f77e

SHA512
0cd5a7b39665e62e819055065bad1053b440597a97f904c4e49d9ddccceb9cfd90c9d8a1ab58e89d3ee7529164ed881aaa0f806d91ef8951d97fdaf71a3bc9ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
202KB

MD5
b948ec2d02e0d7037824174da502e9e9

SHA1
6d71d25b33a0718ed7231fa8640d394ce1c2e583

SHA256
51722e957a0b831b58616cd2feca91ec6c455ee76ecd11a8f0bd51ef7a7753cf

SHA512
b2b4f38c188b4423124e44a7bf2f6a5983bfbd91d281d63883a48567c9b29333afde41e6aaa86052d670d55c587c932399affa37c7860b5910cbab85e89996de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
225KB

MD5
fb614db3db9b7cf8d902e0a7f6904545

SHA1
d74f229e4b74bcf23c106df4e7a92ace2ef8f537

SHA256
b4d44842b73d5126b8b2aa1a7b9c42c966fa167fadb3f6c7617aa00612165458

SHA512
e9042aadb45a0931d7d74875d9ec576757b58e44c02096f26ae4f21932ced8981cab7f974ae274d605eda62bf248b2161100311885f949ee4c87b497900a3a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
61KB

MD5
178661548f489941822c4c3f538aa3e3

SHA1
7ccb92bab15bb43784f995cc85abedaba9f2c12d

SHA256
de0717f0e9e3a25f250db2338f1e44f0eac987aacee1babffd4ced38dcab713b

SHA512
1341c0b29aabf6672596874e1b7914c1e53a008fbb4379e6af91dee7820f91da8f2b39358a01e0c4cd35908b7920335c7815e0fb54e2a75939bf14289f7e99bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
297KB

MD5
c849e485ae8017069a286a8c89d67605

SHA1
03c50612acb2edb98dddab7c21fe355ae49c3a7f

SHA256
a7d728ba8fec3e55a2b0a5ca7f984daeb6091731b40ada4b06ea0abc2ec68137

SHA512
c4817fbbf5cd118254131dc32d8df65f7cc646841c8a5cc92380c161443cb84e9ba48fb42fa61d64196107847f0f5b7a3a9ac0a3a5f9a2f7f99771548a6dc253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
49KB

MD5
8991c3ec80ec8fbc41382a55679e3911

SHA1
8cc8cee91d671038acd9e3ae611517d6801b0909

SHA256
f55bacd4a20fef96f5c736a912d1947be85c268df18003395e511c1e860e8800

SHA512
4968a21d8cb9821282d10ba2d19f549a07f996b9fa2cdbcc677ac9901627c71578b1fc65db3ca78e56a47da382e89e52ac16fee8437caa879ece2cfba48c5a6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000084

Filesize
208KB

MD5
4ef894454f037f43dd45ef424b0c0d5e

SHA1
c114b7f1aecf82a32c7a9c9d350cb7425daff75d

SHA256
e5ef5a4af90d7bf566c8e8bf62828aad7b59bdaf7635fb524d04064272dc966b

SHA512
b0379ea732fb65d0ac73c2b7c867dab38540d8b0f2d5731c9e294a67eb71f9a0a6cc58ae3017e388d47fbcf6f441cb61904a735bda9ef57d01d5702bce449cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085

Filesize
144KB

MD5
c683517b0bd8fbf0464961fde907af04

SHA1
bb83b333582e0cc3d4e58d54279681b7c9efa282

SHA256
44c4f5c26fdce8b34b29597b593141074ae0b89862f6c36a9b1394ec789a2ad6

SHA512
6fb24ed9d5b2ab0ebe2f7357a646ca1a613dd6d891965eb867dbec1f2c66a5569e7f708668c1cf605792c0912f6ac1decb94f0811bce28fbdc1b84fcdf8170bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000086

Filesize
29KB

MD5
b93e62fda68b76422b362482ead28366

SHA1
067a161cf9439109f70f045705b117af8f111816

SHA256
53d809a145ae8672e71f6c29d85650cd2dfd8b884138e3e2454ed86a901a09d1

SHA512
4fb31b481358e64ad5b937ed40f514b06406ff77eddb3b5e7b5c3d345e6a8c8b046d82fc5ed74ad8242f90ec1d23482df3d844c23c6ab2850a95ffd565a92209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008c

Filesize
166KB

MD5
c99b1c96ec90b0cb362052ec1fe1b4c0

SHA1
39586a471f0b837c3753600f58bf138ec6890c05

SHA256
5291571699015217ea9fcb67d8c4d27ce479a9d6c0ef42202ae91a62c6913d55

SHA512
cbc37f79de373375d01e61889f137f9109d293ee9148b8416b758bb0aa1dd015dbcb7ad330c3d112f57e02abbae1e0509b63f037b3c71bef00a2b7ad211c7c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000093

Filesize
47KB

MD5
a63f55cd19376ca24a43a13864d13382

SHA1
6b11d3f0392c3ff44486fae4bceb7cefc3c9b068

SHA256
1df1f5660045ef7345694bdc6769b2d51d8988d2454fe3b9a36a4fcd0403d78b

SHA512
348de8f128d27e5a6970d25a183896635fa7cc45062d2ffde5687aedd7e25c69bbcd9631e9807c3fddd0f077237e5f50d39556310ee84a01f07ad3a3aaf887f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009c

Filesize
78KB

MD5
45f462348739c2aebf2b272ed9a41fe7

SHA1
f215270c456cf8bdbc239b66a066eadf24eba41e

SHA256
c727d68d4924d3ef0314eb9320afaaccdc9d1c06005584ba7f6c324f1c5480dd

SHA512
cfe91838056c11c1de976ddfb821af542efb980cc59a8296e602c8a5b59e9efff95fe3d7440c6f479f0cd037e4dec6c39e9c55c3ce2af9a446f4b8ca90bb86a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
90b01f1bf14b246aa33c503e2b280f7e

SHA1
bc54a6224ffdbaa8100b7666f7de76b45b739e32

SHA256
a0194c83842a02890796fb8e83d6b85ca98c9176405ae95e7059e92131e668ef

SHA512
2dcc2fdcd9b7888c4fdaed3b0caae0dd0b3cfd333a21b2a3863d13c056aad14ebfa3e808538ad1fe805d8d5eb3d39b80564750c476f36a776d1a4b234ce1488b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7ce3a8345c7da03fe147d558105c890f

SHA1
fb53ad97e06750dca5268c02818effe3a99737c6

SHA256
6e64937249fb74b5595c7f48d95ce97a65d9d16e1f3699cab56e6b75e4962bb3

SHA512
7f3568b8d85ace5cd3a921ed3e635d437f9cadcec4fedf287cca3c0b8f0f61f9eef0920d4785ccb703f8f944628bcb19bda1d4253dbc2c422739591d7c7d33e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5f5b960a134b03b9b286343ebba50b2f

SHA1
497dc98fc94d7f1725321fc06042db6bc3de619a

SHA256
851ed80a1a55f9bf7bc5959ec873b4588f16b455963e9b8f2120c5964b1adbcc

SHA512
616f7c357cf75dc69acad1743c82461bb3cc54e17864170877506b6f987f0faa19e84d8ca05ece93203f6fb5584cf4c6ec43eeef25c58ae1369867faf00abc25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d667e3e2fb7d4beb7dd49cb0114d4e09

SHA1
caf8617763c64732ac99d4ed90951d7cbe74e949

SHA256
ea9a2788e3cbf3524641b58bfc9a0b9be2766ec172d2863d81f05d57c7f92993

SHA512
32d87a6005f5f15de68b2f97abb226ac5aa433b6ab8aac3dd684db97756299132eb6f33a1a3c64145f528bc30f84dd4ac88ad99e9e56cb5f8ebf422f2df655b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e1c67e38ec16bb88333ca36f2710cb00

SHA1
59ef0705eb2fdb6fc7e2a92c121e10277a9c6c7b

SHA256
cbe2d59f834d96696e70fc77f42e57d3a42f39aaf9cf32b976dcd5278c367a5d

SHA512
08048733294f697479db635ba5e971ee053fb913918582ceed9efebab82a7c8292aabfa036ca1d61b18c8728ed83f4791a2f37e4279a00cd79765c8d496843a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
80a1e3626fed663c626c50d35968e1f2

SHA1
c553cb2e5afe956a71e9e98023b435dd9c23b76f

SHA256
08f264d07fe96e49a57093c6940e5e201c9134ce4930d4aede30c712a295f583

SHA512
60f2036cfe2c5c2c256ef46f581277875d1122eb426e4f30fcbabde9ff1e612901c448ada0e06117d09b2ea358558f2ea7b3745dd6f5911b5cdbe30db7900316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9422012b6ec4d38e23a6d209c06a7935

SHA1
0f2f9fe324d5350d74ae57c83e718e774c91a6cb

SHA256
97c3f2a141703c09a80b1778089ce7e152d2fcb2d572ba580158f5d3be1b454b

SHA512
e9f4736faa9ab1f22729b0c1e93896fdf3365331aa9160a5a4d484766177212f639dd34abfc138db11ac0974ac4e34f5d8a382bc0aea0b3615b39c8e640d2157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e61fac8ce5d2f4441a6703ff274fccae

SHA1
805ad2fb0f84c037d7b32d2c737b89afe824be13

SHA256
77583aca76572902d28db9db6cecb544209b5a5e8e6ac4b4eab48aed67158205

SHA512
41f53ea4a52eb4ecbe0c391202de7039fd3bf86c2ec0b5296a351077913328fde5953891e2672e87ad0326a4869b2f6feb11a1c6cc96bfd369cd3f6f5b861003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
15d2e59c72212d54334c2bcfa2084dae

SHA1
301d9e7b38873241af9503120b189b9bf17bfc6c

SHA256
04bb54abb37ae041eaace4d42116783e640b87f2a94374ceef16450bab7f9a13

SHA512
fd195d945da6b05c907b2fea4f5cec4ebceebb1c0384ffd75723b01a4f1e299940a3b76f2b50d6229f43fb17dcddeefdb945467632de0d3eecd1c2ae91af07e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0ed934dd10555bdf8e1a622fc586b78

SHA1
0667fa3271f01fcbb54ead5970701aabaee16a39

SHA256
fc2a55a72756c0872e1d6c4f729abe9b0a347ac376367b58c5f0189f46f856e3

SHA512
73811e7d6addd01941dc735bdbdb66b60a856b68dfe02dad54f4fdbf4843beda30ac30b79e7c399955ab8f0834a42ce90fe5fff11b569518312a1ec2e15c90af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46d2d4e7fb6dc8adc274238dc143b2e1

SHA1
8439f15f8482c7664bdaf3b2f2628426b06acf2c

SHA256
8469efe995d65155ee153c61888c93caf4b42efea9d486c75d574b2f6b779a9b

SHA512
b27911bcb296c8ffc8fba0debd7f3e8ff1f8d12c48cc645ce74805bab6370ecc2e198b7d975ffd96eeae651fd6959a7a4624928f6b61cbbccc891f78be39b9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
650bc67fc72d8aeb2ecc4de0d205b048

SHA1
240c5b718c805b16bf5e651b3060c68ef986c4b6

SHA256
f324b239728f49560ad04e3e8d713560e3866be7f9555a825cc1e8e54df69b60

SHA512
695dda0590f7af9ba27d5def64f2dfce05ff9c8998eb322c11feeb6e0a1bcaaf1d518524d3427a4afce06d94d434f0756feb916b1f6e6dc7ec620e3bb2374af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0d9cb219452322f3328ad949995b726

SHA1
c30518fcdca217e3c24f395ddbccec45e7bc8189

SHA256
54d7bcc1549c0cbc73211ce1cccc8775cb1e2ca9ae1f3f367f5ec6a7ba3e28ed

SHA512
8456b160f23e5f233b354898b77a6dbf19bc07a52c848c1ebf7c8189f15d5d745f21fcabd1617aeda293cf8989af4fb9bc93b8e4cdd6f01b8b2fc6fa390a4466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ab7ffedf91d853c688c2e3486bf6113

SHA1
5e6b683e931b909951f7475ed7590ae28a9209d5

SHA256
a4502d76ba7028f34dfd95384fda885f1cee088cc6e9a2f19e574c5bea292473

SHA512
498c91e0664667068f2259083297366f6674b98b695a6e9fad59c91d05de02acad59f795597fbd101390fcb432c38c2743c3160593b6beed2751ef43d88bce34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4812712e401de860cb43955e0c49f6db

SHA1
7bf6610a15537ab3eb004bd1f7a181ed1a48494f

SHA256
f83cbe7d42dd0ab4ee07e57a36f896c1104c7eb399aad2bb0a023fec74f591e7

SHA512
d93da94c06a1ad0821f1ec4a4ed3b729410e43d522c60e17d19b5170c2d49b9a6c5ddf56598ffbf0a09100ba13e0efebc6cf4e1eb910a1d61688ccc951d1401e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
93f184226dd1aa8640fc19b1896d93e9

SHA1
75df6963b7f57baef443de2b68436bf58e8db3d0

SHA256
8f506892774d579a1a665945f14f7295a3727e25974336a7cda22446f1b79d84

SHA512
e1bf28e421464a7c6731c48f8aa89d8d38f61244a4e2c110d7911ee475b1afc28ef5eba57bd606603295ad9c6f1ade87732820df166b821514fbcd4d88fd3c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67eec4960fdc58ab6354615b0695757e

SHA1
ff064588fc614bf479f8434748ea114c7455460a

SHA256
22cb57d8810f85371321897208ab1873116475ac1aabd003727bda8fef071899

SHA512
d7071210c4c920bb8bb5420f93d9d7f32aeb446ada3cc4fdcf6a0c1ee1f3646529d2307d878c3a0dbac97d4e6082d8a1f693729d1fd9e4fba1017ba741459e30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f21c9f59f1aa159606f5cfb9dadce79d

SHA1
9ac860d581a8a364bba1c0f7157f15f917f13f8c

SHA256
2aa6d374ad0b1ac520e6918f1b0405e6e26f7c55a8a66cbde94df57b2fa0c946

SHA512
2a3618cdb7bb27b22d49ceb3f70e143240e87d896d086883cc85a348a23214a39977dda8a16ec4b3072211d9cd345bc6de58cd470c65ef69b961808e24a7dd92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98e8cde85b59d70922d7b45e4253d79a

SHA1
311f469564e166acbd2b265bfbebb1ed8f7abc2c

SHA256
87ff478fa5dd443bac930c76f2600bf7639bd7cf507c0cccde7191db0f6853f8

SHA512
f2b9be34cd3ae3a3387f54f717305ed28f98321923fd254e3924c0c81e293694add681e8463b56bbf75a1acc280246bf4056338f20ced2154d2a67961c75a71c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dee398126e0c5f39c23976a64b01a5e3

SHA1
1e4a793cea68e68f0287cca9dfe2c9ba1e91b855

SHA256
525badfe28c9bfcab2745addb6a3f6b550d988cdb404819c5d226903f4aa695c

SHA512
894395fd364b1c7a0fe333504955299484827654b9298832045cac805ef594fe5009d5637d39d23eb6375a371e29e5020ce2774895cdaabacfc5499c78c212e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ce2169f21d54c8a25b95c354e26c18e7

SHA1
7befd8c2f440dbfa99515869e7fe0d7902043929

SHA256
3279d861c59a2055de702de5dddf863a015ecd992ee9ad33191c93e7a6e71964

SHA512
d9e714c4ad9779202652e3cd57d5296a847ee6e7052d3853723a022e10189ba17fc04ddbc07d450d9c26e3fa0f002ad36c49343fdd26e3ae467d9d9fb36b8f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a2ef1185679c191e86dcb50402639f9d

SHA1
143f019e6ab3e0f52625931dbfa7774ea7b7af05

SHA256
a517908a7aa2e4fb66a287d41e25200da0d56296496e863af725a06a829309c4

SHA512
9cccbb4c4b99e5977f6167536f634bb7adcc035762703d428f6a4256f998929ce6981a1bd2a3d7416cc7b1b9600a6447a14c64159b3816bf5a0d5f0ea023a855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
67ee2188a2fa62b0afb8e76a8b60745e

SHA1
fc5f5826bad02acdabd54885a279974b0955c67e

SHA256
a1bdd93ceb07af3fd0f303ed491c9476193bdd8a33f012635970bd36b684c896

SHA512
90c4245b4a9bdd40c7fe95ec49b06e563d3b223a59a2089a56b911a599425c644f5d1305792d7ccfe3670db4b75ca31e030cf872cda3a8cb84eeaa4eaf620438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e3157d97568bd6ca0ca5f671db916b19

SHA1
81ef44accbcf59fdbc502f6d079a9847ff1c3541

SHA256
f5e192bdbdae9b2451adabb0da52c2e71dd17c43acf1989e71d0c8cb51d6d7e1

SHA512
52a4262fd8d4360493c21dd2b57d2eeed1765c31565400875c20b4fa4b7222d699b017ea147c1b0fee07283a38e012c1cc8fa7ba53e662c9fee2910871abe096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fdb2db51a5222d47410c15cbc5ddc2c7

SHA1
991c22e415074c5fc3213fdcca18d2648f728aa7

SHA256
63b42edb773e21f096320b5f7382784e03cb7699c7a1ba5cd33274ca026cb069

SHA512
b7a94d11ac57e514fb71308b4bc306814572a55eaff705e8aa3f72128c7a23fbeae8e39fb981889605a76ba1963059dff4e232ff4702e13d5cf7e10f9ba40a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9ba94b2d821a8a16b3a646112147c63f

SHA1
fa95ffa9d25feddb244eacfea28cec8134fe8208

SHA256
42c35bd0ad6db2a2d416b4e5bd972e5d1de6899708d1d414b17f817d6217bb12

SHA512
7ef75d400e3018a876ebd2a6d1bb60a11c429a1ad77e5010244ebe2e9059f6d36c5046b119c5fa1c7a4a7fb4d66c292e6e1f63919a0a406aefe32d2b5128f56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584a43.TMP

Filesize
1KB

MD5
d83202fab9035350dd09a7205435275b

SHA1
13df5d069e64ba0d4583a17b86a9eea94bf70a5e

SHA256
8a4c6ba057004094f436e428c5f248f7bdece24fbcad648a514832ca96f5549d

SHA512
36ca27306ce7b9bdd2ceefb315caf484083852fc1de325226a4143475699586bdfb0c759cf19b53b1dfb5e336e1731454ac24c73284eff6bc744f744cd0b1870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24f1699cb891b07349fa80d91c6b25f5

SHA1
0e6d2263900cb94fecbfb0b352b1d77696e73049

SHA256
71a55bbff58f5bbba6d3dd683085720413178384c1ca48a01dca90454883aeb6

SHA512
90328f8b0a3539fd4539be774b38b31b44f65172337c2c4b3abd714c4f5b2007804a8554b72681a58d81cd3347f9ef4a2add3c61d2cc7f1e1ffd9f00d2ca9826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3183a76caf7ac58916e30ead4ccb1372

SHA1
45104e637721cf705e211e8ec96e9e22e0c74a2a

SHA256
bb4c9b7e730f1145db9a5276feea7d83f669e41cad823df3ce239486199566ce

SHA512
18066548a6f5bdeece5dfd8a6ca21c2499a44189b9b02d00ba0749607046ccb9a78308614769226f9d5c1beeeca3d4625a56ae4341466fb8f87276df31463af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
053b4d65a3025fba1235461287c9b7c5

SHA1
7b393ec748668de371a558d2fa8ca9cec7f68866

SHA256
3a7e53c769a754259375da542b8d8b11f93f7e3e593867ce4e6c18c3c23cd5d8

SHA512
ea29e5fd84ae410452c30fbe6996eb125e09debbe75117df0dd3b0c3f3197a47875d7de93c910e8ada9b02cf01d4cfdeaec1b633d74fc87188c7c38c46b04c0b

Download Submit
C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt

Filesize
36B

MD5
51996f06f037b3dc30a10835e3d69707

SHA1
6a51bad6ddf14e508662d0ca23532f901b30f9ef

SHA256
2b981517009d254d208de64992c7303e7eb8c0cdaf9d3d1be327b04c931ad6db

SHA512
218f9175a6d2ef163981446043f6eab749a916515b9c4c65950e07665f0f2acd06700bc870d2fcdd3af1fd0d2d202006222a279601725cfdf1b16001ffedcdd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg

Filesize
3KB

MD5
f90a03d152e8202c3eb57c6e6eb710a8

SHA1
cab5b11304ebbb9a1ca9c191fbc737082bcb49b9

SHA256
89eb956a0ac5a7ebd558eaaebe485c87c40c47baf1954b272b26b0b8724a6352

SHA512
2e3e8c359ee1b97e5a01aff6192fd39236f14cd75812fb9ec2488e938c52db294c859062d89b84f6593d3c492d310fe6b514df235b52dec189e7b62e02bd86fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe

Filesize
557KB

MD5
8a4e72a29c08ae2cd13bc8ec414b8fc6

SHA1
26f8d73bc6f5ace5cec6e3652fc6410a71298498

SHA256
6513546697c3c9deb50d8dbb0cc9aa0be55487538ed482ec16b6264579de1539

SHA512
77eba566c65de1327bcacadb1483f538b4e5da67c3607398d745173ade25e987f59524a5ecf065dd5f95e26654cbb5a48dc80fae995d5d2dd63c63b2cd98fb98

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE12F.tmp

Filesize
9KB

MD5
9d57b341d16b7c107c1e05f0148c86bb

SHA1
d6464878f9ddfd303536f54ab1bd3d7ed2eb16c3

SHA256
717a404053f81c2766d7e705ab71e54b5d5adc7fa42f848651064af20512a157

SHA512
6fb8de6c023bc854def7fabc9e55a3871bb5803efe18e0b943dc0507f24c3a8f79971b57bccc9b3bedbb73258dd6a90120d9854c24d90e7aad2b0244a6981460

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE15D.tmp

Filesize
270B

MD5
edcaaed49057b04d804ef38622dcfeca

SHA1
200458ae3a380983860136acca9b18d62c5bac76

SHA256
b9532ca922a984f207d3a82499308fa038e1d78169b534b8d7fc116aefe5a05e

SHA512
052065767b3bf96cf1314dd8c42940ace0d256eb7f536de0b642f5816dc0b5e6db3ce9a10450e9564b7c932e9261a9d78ca7929a4537646cbf7d5ee8c363b5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE390.tmp

Filesize
598B

MD5
5727f9b6b363a2069f4d7cabcbc96d5e

SHA1
0f8fe52b8675ed70e8d0c2ee8e11c524d0b75bbd

SHA256
464223417b29ad1b472496202612117e608fb8bce016f630dbb281baa0d46810

SHA512
a57b2673b088791193e1bd915e80280c7d872a4f3a4409170997bd5bb64ecc30b65e302625d218b3af8e3a0d274ce173acc3b45f7c7c0e341f708793fcf9351b

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE3FD.tmp

Filesize
447KB

MD5
ff95b1847423140b323fab2d9b139a5a

SHA1
c4f5b59d8b84866c6a70fb4e221d8f80cbccabe1

SHA256
8d70c5b8f69f4c25a344579a6c8db67b0c88111343966b511c01b00eccafdc9f

SHA512
65b738b3047565ce8120aca86e997f4fba3bd38c247fb4affc0842e3b290473f3cd86d9eeede629480c907d90ee0b38cb89312186d02adab53890a9789d7fd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE47A.tmp

Filesize
4.3MB

MD5
334ed905320cb345ea97c0d27557c708

SHA1
86c4a63c4b041851ca2cecf5140338cb8ca24335

SHA256
162e88c3814e0337d14595f9720f8d290ab4c5075dda6db91cb59ac8cb84c5f5

SHA512
8cd81a0ae662cd76858bb59b8e35c4c701bf8800a6da2c77024e69fe0c3e6a6e0efe5fb39135af6a45fb74db98ebf1ff572dc10af850c4b7f629044a48b9201e

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE891.tmp

Filesize
389KB

MD5
f2fb80e5d65b57300eb40983720b52af

SHA1
f9e16ea7869ea9a941ff27ccae8fbfbcf622a9b7

SHA256
57c773c8e34849d40eddf311dc67862d56d8d57b51a08861383a6546574fb33e

SHA512
abdc5c7b623f80df8f5bc91269ee339a45793867cd432a9d3b322b630b6445b763b70254f8d3ab7402a004cca8a9b612ef3b43927ccedd61df0d411cf24adb8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE93D.tmp

Filesize
12KB

MD5
cc7228e473b274c95a283ba22ad7eefb

SHA1
9349e51e20c89d1e925ef1619c19cc125a0daa0f

SHA256
3e3f598751ed5d77b5b3f2912d67c205de7ebc30a815e36f79dc45556676b08d

SHA512
7e94e24d0af4b756f95b1ce581707839717d218efa48f4ffb35bb1c75443f14fd142023b58f895bde6f5f2660c6f06a87c4ceb2fade1ac72d39f49c2ca4dd4b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGE96C.tmp

Filesize
740B

MD5
5b20f739acefbfc6237c04f216466883

SHA1
738af05cf8a177e14726ae4c4affc6d9b94da6a1

SHA256
f787f543d052d4000d007bdcd71bb6b7024293f2ad2d543b02b4121b1da3ebf8

SHA512
c82cf736af02ffe5e76b88d802e7800787826bbe5cbc59b64b4f77f9ff1168f9ed43a9c68e3a9d13407e38f16822755660d359b42ae339d0d2bac754f192651f

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGEB12.tmp

Filesize
3KB

MD5
cca36a379e81a944c607e4f4d544c565

SHA1
d09aef7d6cf0bd140f121a85ae2b92307119db89

SHA256
8975303228de2bf10d7a55bfbd591bce14e4a124910265eefbeb58229347268c

SHA512
8a851c8054c694dcf0b942550de764915f0c860277f910fa0fa6d66962f7e6c7a7c8498a0abd55e51e6725fb585820a957c079351883429242e4c0abf7f79158

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGEBAE.tmp

Filesize
4KB

MD5
9a6b92b10fa585333d0291ac3d87537f

SHA1
9536e72a6f059ff86deaefac6676305fdb23530b

SHA256
713b38ef078f28703e15256cb30ccdf5e496256f9b0e92768d0a63be39c3e825

SHA512
28605010c1a45e8d08e1b4ab82a697694ed977213902707a03f6da0570b37cfdba00002e29ad072273d3353e18200d763e2f05cc504c36fec53778288ad5691a

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGEBED.tmp

Filesize
3KB

MD5
79d558a3f5a649a98ac348ed8a0bf6dc

SHA1
5cc1a6a3339b3104af499a8d44fc426d54021e85

SHA256
23237d250e185d524d26dbdc6ce16adffa9a0b65af35fefac3bf0d01004d5bd5

SHA512
6ff24db910fd94551806670d922c31802e4f49dc68e1fc31d33cae1269822c6324563672804f0eb8fccaf2191281d860f74f243b0effcb844ebb3ec8044f85d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\REGEC3B.tmp

Filesize
10KB

MD5
b0223e1939178bf83ef084f4d98d27fa

SHA1
5d1b1aaa0e159fb6ab3370c473f38c7910b28663

SHA256
beb092700ad0e8e12c2d46c23b5f56c78fccdf25291f92fbf9f56f205f59f10d

SHA512
707d24203e0adeaa521d62f3e7b4bf4b73f17849294a7f33e8dc89d563c942a7cebc08bbd1d55d9ca3d46be835983e9310386c2339cea930a50ee862f97f01d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32zuoapo.a0t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
7e4cd3eb2e78de61c0be5ba25f88c4c5

SHA1
8c4fc5605c7a684c5a887ba744e98e1f8d5a4e37

SHA256
e54e15b9be128511f34dae6075be6fd7f0603549918dbd9483ee5d9cc54d8c11

SHA512
4242b99fe217719c5d3a3b828ba85b5657509691b6b7f66ac560f30d4fb99bf54e85918be0b2de76b0d8d174a4d1bd9dd155771ecf92a5ad974259592eba5a31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
f9e7cdd6b22c07a8fc88f2068abc43c0

SHA1
2ade2bf933d2bf61264d9df2684b9a494087f5b6

SHA256
08a7dcce8413b7fd9d887eb13d5059b44b259967414490171797b0637d0f22d0

SHA512
50f9655bc65b9bba16c8ed2602b17a7e39c437a9aa38fb5d9950a8e087f8e4d3c710c469b82055fec217eb7e362bc8e79ece0ac54ea41f9f472e770f024663e4

Download Submit
C:\Users\Admin\Downloads\MinecraftInstaller.exe

Filesize
32.3MB

MD5
4f02ac057355b5dc73ea28aecd2d56b4

SHA1
32591cb75779a3e308a44e75a76f821e7dee11e0

SHA256
83a5f942b2a15eab4826ef1709ec6a7f9637a7ec0fce16585776848797307fa4

SHA512
9eb08f85559df6af9192bec8904097d4e43a832ba9e9cc1c7be1a366af8d103c3a6db3886f00927ae5eb62055fbc770c7b5a3d2a122a0b460b51136083015368

Download Submit
C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5338.tmp

Filesize
11KB

MD5
3e5f7bfca0c5481f2163a7a6266f1151

SHA1
7fd25ee54cbd676ae328f2c876fa8cfe0d74e72e

SHA256
7cb8a25cfc80ff5af4f92a12002d1d205cbd72b02687d79df49c9e4ff6b0fc40

SHA512
520c997d280e20fe843ea95d727f8e5f36273bc229af97b95b06111aa7e2528f63d1abe092eca44d3a9ed1da218eb9ab96862b40cbd46c40bff35b39abe0a480

Download Submit
C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5358.tmp

Filesize
2KB

MD5
24299170ddea41ab932913594afba03e

SHA1
3067da5552dade50c622864c485ac40937e464f7

SHA256
2bcc53f73d3efc31f278cb4fdbb988a5930bf182b238b6266d66177d2f773805

SHA512
23b7d0dcfd1681d2f8ceb63c459ad6f4c224e6b1bde502d3a2fbc316a1e3cf034b13b4de10f0552aa7825f9c87380f9ecfed0800f6cafbe51bcf83d70d0641cd

Download Submit
C:\Windows\System32\DriverStore\Temp\{450a3157-4d3a-b744-8b06-c21ed854d014}\SET5359.tmp

Filesize
163KB

MD5
da1ffeb1868c97814b03968554a4b521

SHA1
a5d856b759ea24086fc124774e6a55fc0f213ce7

SHA256
4223c7f9a03a581f66efcf2f8d356ec1ca8d1e14fd4d60a33dc97029f2d1e92c

SHA512
f66e03fb53356c2d115b86ce77121b85da45c7180ea5cb2038a2fa4a505f65fea52ca250a72fe4344d20ff8db30b4ae39d4e8f0b7a94f34a4db51c0a69cb4d95

Download Submit
C:\Windows\System32\DriverStore\Temp\{950ba7c6-f9e3-3948-9e74-758b76818034}\SET4F8F.tmp

Filesize
11KB

MD5
56dbca830c32461eaa115edfa1689165

SHA1
bfb8fbeceb88ecdc83b1748b0561cfdd8a99982a

SHA256
c0733e083cb7ba46a33abe9ce02f42c3798d42fa677ebfedf7db0ba33b4c4f3c

SHA512
328f7c9d59ddf1a23fb32851c3d9913a95e10dbb603361958f6b58016483b8f124f497a344552097d5ebad16be34d4d93b720e0eb307673795b4d2b1bb1ff97f

Download Submit
C:\Windows\System32\DriverStore\Temp\{950ba7c6-f9e3-3948-9e74-758b76818034}\SET4F90.tmp

Filesize
1KB

MD5
dd2ba3345585534127a68f99bc8fe271

SHA1
03934c1c3cbad0271a06d65906c20b9c3284f696

SHA256
3a6c9a6002cae5e7027c3e67a56849e830d7a9444df83dd688614fb1b43b0e5b

SHA512
83691f730eb3c21f76d935e04ab931217ca1a6801d477acdf98e50b7afb99ceb020c165e9cae5525607daded294e335f87332577690829000719784e350a79c5

Download Submit
C:\Windows\System32\DriverStore\Temp\{950ba7c6-f9e3-3948-9e74-758b76818034}\SET4FA0.tmp

Filesize
643KB

MD5
184dbc69fefbee3570b36f851eda4aaf

SHA1
ca670a59d099ab62d5985e0692d3d200609f0386

SHA256
2f4dbcf7563ce41a8c3f82f411a5ebab7803af57503aeea834301254ecb8abb5

SHA512
1a8c7556f761e04cb052a5345ad7b95cdd6622a0ab3d4a56d15b8ac31f35b5d226d8e24c56cde2f6491bea72cee5cbbaa0a5e6a38f2cabfe11f4582c45f346ac

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
37KB

MD5
b13ce45e990d4b08f98a1ed788e595c5

SHA1
94a0d2bbf1c7f657ed7efb6fa6089b3c87875b78

SHA256
985d375c500232a2e3e2815cdabbedba8d28d6a5b257745d56093608baf636e9

SHA512
3a1e3a3f5f4feaafa91cc12dc495a746dac1cde5c922f8f5c876fc53940df688a445c6ce3e04ce5181b2e480d7b5b275515f7c487231e75ddfb817fef0de4677

Download Submit
C:\Windows\System32\gameconfighelper.dll

Filesize
237KB

MD5
293984c93304230404214ec46b3e8cf4

SHA1
874a55dc92d5b1210f2c2427210b8203a528508c

SHA256
e07f70c49caf183a22648e6ccdd75fbf1dbedcb1c7361adfe377c6f982b0b4c3

SHA512
1f89056fc6c648a29d5f9301b3c3032f1ac104c79c5f7895e1643c3d4baa4d85167b8f4295ba2b2aa937737c4f09350dd0b77b9bd5ecb97c78f3a3754f61254e

Download Submit
C:\Windows\System32\gamelaunchhelper.dll

Filesize
253KB

MD5
8151a9f9cef7d3558f9b263d19b23a20

SHA1
7033042df8477a455ceea79072d0b2afda7034a7

SHA256
6aa9ddb46bc47c66559a390ee307b0235b4d4d8b24f137b3165bb426641d42d8

SHA512
a880e8eed51657c73ead576e78f9986f016e8091c6b6d5fd8e4091806a0abcd4d577ed027d612d35cfddaf493be6ad7eedc8a952313a2f62dd473fa8772160d5

Download Submit
C:\Windows\System32\gameplatformservices.dll

Filesize
757KB

MD5
3c5c85456b91a4027c96f3e78545cdc6

SHA1
21bf80917b798174befe7637885d18f389a7467c

SHA256
aced27f6aac786d9877d1e943c26dca3d8b1c34ff7d4a27f2e5ae5c5644042a2

SHA512
f2bcb0c1f210bb7ef00bee869803b63faa335c2c81557fb183d1026cab026dda13490677244e49c3fc1d682a699fb9e0dfb81572adc4d86a172bbf1ed23acf11

Download Submit
C:\Windows\System32\gamingservicesproxy_6.dll

Filesize
289KB

MD5
761df9b19ede97a5487f0fd682616ed9

SHA1
d2865955c3611e6607c3b5dad4d85cfa90d3d0e7

SHA256
ce6d1c8059bcc41a07bddea38ac3735e47a2c15d4d2ea4c8779e4624cd45007b

SHA512
2e6d32bdaea9a4db5c8f86b46f120f58172fc6da7b14bf24ba012dab4ba114c8a2e3825c9ec9a321a07194abc354c0287fc508f46b182a2cc8bb9307960ccc79

Download Submit
C:\Windows\System32\gamingtcuihelpers.dll

Filesize
149KB

MD5
45726bda5a98f85551bee8767573e853

SHA1
bbbc9e525f1f1628e576c9d2b531c2f0f5472a36

SHA256
7047441faa52966f8029127a96bdffc0ea6554a3571ee4a9bbf0af871c8d3a35

SHA512
102c8b91aa69025082f85e955ddb5734b714f84715ff56ee59731fcb4d35a575ab5bc1cd028f90f7eea8efafc7fa870e248f175d17416edda08bdc88ef41f499

Download Submit
C:\Windows\System32\xgamecontrol.exe

Filesize
73KB

MD5
c4ca5ade21d5af44b482a71e72c9e1e7

SHA1
1a8746c19cb5698a4d77cd73a8b6b7c48b1419ca

SHA256
9fc049319797e9fb1c5516631eec86b0b32dfba47057a85c1a5db2312939792d

SHA512
33fad569a3b7ffadcf4af281e92a16fec54ad7b2a368236e2e0ce115dd8352329722944771f4b8d9c8dfb5dde1623d928b5af8d03b0f61583ae610de08e019cc

Download Submit
C:\Windows\System32\xgamehelper.exe

Filesize
121KB

MD5
ea104e962dca565d2898b0494fdd9635

SHA1
3f46e8d5bbe4d2b1542b496d4735968abedc8da7

SHA256
68a93b5683ae8981e7ca0f6c5fefca91b7b1890a209dce24d2754317d9efcc35

SHA512
5485f4db6c9dbe2efd804f7eecce07793b3cf05d3ae085e421c1f4619106ccc9620f0aed6d0621439a49f1a43bdfbe2491c4406f61aa0a4248d1862979f8d566

Download Submit
C:\Windows\System32\xgameruntime.dll

Filesize
2.7MB

MD5
866a1a718aceb23aa5d744a57fca7597

SHA1
d1c5e67451e428380bb253414913b591f2d98b6a

SHA256
32cd023e9c3208711698fc0234a8142043f5e1e0f299308a6b62b8db2ca050f6

SHA512
fe423f6983c34a992972f48c656463625e8d1c21f3b34617a585547a5c8fa23e39fe4d10a6b00f24171107a27d8e0f3217679c7fd33be2bc0f4bd03d24974555

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\CL_SetupEnv.ps1

Filesize
5KB

MD5
4ddf0c498640c370e1784e79f0fdac92

SHA1
b51b2181f848e37750ef4990f541fc101a3fbccb

SHA256
9077f7333d2a6e2128964b82ee75d852eb8254b3f859fdc8f351d276c9cbc97d

SHA512
223d07ff369f89ff26d141b25f1c94d5f03772a61b2afd6e95c465ce49bb0588a708c3d4646c38173f71c0e2b38d50158a7dd4075ec9184c29e6d5eeb4f34555

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\CL_Utility.ps1

Filesize
3KB

MD5
1214973d075474ef5b2f6e146228790e

SHA1
e7aad84340db77b0b83a7d0ef34ecbc71ca17b55

SHA256
6facc78db7bd38aa4d0064f860f3b3e1a371549625b09177e291f723e938f147

SHA512
1f748cf98f1cf4fbc30e3d56b7e68c3ef592a2d8e900d5fd4a7890065b61bde9b3db07344c70c4fb0ee8e9482e3732783fe8f808fbdd28cc960fa2d54d689e56

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\RC_Pendingrestart.ps1

Filesize
960B

MD5
fbe432569a75e8d646b5fd3d14b70deb

SHA1
23fae396480a8cdaa4705372947cfd89b6dca2c1

SHA256
128f5a8a0df3549175f6a80d38d97a42f9086425ecb191e9965f97dd2590608e

SHA512
6a89f3fc9d5259e32a18c0bac50296d2dfa4d1308900da5941dd874e72252f2259302acac9b2263a38a9b7bd851d805c48e4b6741e92f6bfc8f12fd4284489d9

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\TS_Main.ps1

Filesize
3KB

MD5
9f73b819ca1f285afb1531ce8d255fd8

SHA1
a1e6377b540a26b7a3f79d0cdf645f5bce292b8c

SHA256
1a7e22f7e0d45ab58b965b5adbed5f5c53d4d7a98feb01a956cf5f052868cb84

SHA512
7f3f538486a7f2f894999dc1202906caf13bc0e810ea849529304f4a66a9fa9c33f607ba85c061b8c89125a1725dc43d68cab3eb614ab8aa91159cd65726b3f2

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\cl_Service.ps1

Filesize
4KB

MD5
e9c7251335c9fd0da44321fc4355d429

SHA1
9376085dda11223ce09844216721c29c1ebc394b

SHA256
7c8d05cf9d82729e24e371a8ad9f8d47c191bf7980bce9e3abe3d8986268d9ab

SHA512
397513ba1eb1a4dfdc0c8f2b91c1307cad847179cfd77acdd9bd5fa3ee9d7980fadbc946b457e7e1c22c96398901d090f2b27305a81da4d5695d881c01a173d0

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\cl_windowsupdate.ps1

Filesize
13KB

MD5
a33c56824341bd79927a2d2fc687e58c

SHA1
094ce6d8f3cd8372df2d8ac6f4b88d8a35f519eb

SHA256
0e5c9cac5b2697acb2ee059fac8189be9aafc244e99b41566c009d6528ec7175

SHA512
b548beb024b437c3d75eccfc4f4343b68b1f30ee024f0749a24c8d0c53f4ea0b1b41685bf502d6700bd240f2ffc23cde0e9feb90ca6d1fe96a28ee4435ab19f9

Download Submit
C:\Windows\TEMP\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\en-US\CL_LocalizationData.psd1

Filesize
1KB

MD5
9f445f0aecd769bdbf01880fa071e3bd

SHA1
f5c1d9df0c788c56e443ce725e5f25b55a29c44b

SHA256
123c59ba4994b75f4be87ecbe8083bd65fe4186defe2df09eb879b33bd5ed800

SHA512
86d63bc8e21c6a69cf93a227f8430c0017c1346787dc07f6e55e13fa29037f0c69bcc13783e3ea3adb3f7568a1f923c54f05e8377f393477e8b7b613156ea0d0

Download Submit
C:\Windows\Temp\SDIAG_6917a04d-3249-40aa-a275-6bfb83b9645c\DiagPackage.dll

Filesize
478KB

MD5
580dc3658fa3fe42c41c99c52a9ce6b0

SHA1
3c4be12c6e3679a6c2267f88363bbd0e6e00cac5

SHA256
5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2

SHA512
68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2

Download Submit
C:\Windows\Temp\SDIAG_6917a04d-3249-40aa-a275-6bfb83b9645c\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44c4385447d4fa46b407fc47c8a467d0

SHA1
41e4e0e83b74943f5c41648f263b832419c05256

SHA256
8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4

SHA512
191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005

Download Submit
C:\Windows\Temp\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\DiagPackage.dll

Filesize
77KB

MD5
458bc0d439cb0d955120ae319c6ed91b

SHA1
b8899daffcbf912462d7e089d126d664c1a40216

SHA256
9454ec899ff78ff14c4c5137ba23d99dfaba079c629afd790640d0f07724201c

SHA512
fda4a2641db70fabc10d73dc28dc13f3b85140a382e032fa7a46abd5eb72e076f96794ccbc0f344a0cc88222fe27ee527a3587eed286e3e3db338824950369c0

Download Submit
C:\Windows\Temp\SDIAG_86d5cd0b-c632-4aff-850d-a916bc7c0769\en-US\DiagPackage.dll.mui

Filesize
6KB

MD5
84d58b706a4a16e582a140f72110b7f5

SHA1
bb7a3f254dde61f948417eabdc5a0883d102d873

SHA256
4b012aeaa40324691c6af926d5bb27409232fe8c484fd295d64925fc36f31060

SHA512
9f520c9d00586d9fb8a87b904d75616ca18b6dc3badd1db71ee85236a6bba459d56eee6ba29ae8cd2139fda8e5df961b232ad87a17fb4dbe61dd4422d804c508

Download Submit
C:\Windows\Temp\SDIAG_c45bcee4-c058-4ddc-81a6-da08f8044ca7\DiagPackage.dll

Filesize
77KB

MD5
fc7504df42668c2918657d1b9a3102c9

SHA1
5f9a70a31678e2e8b9a10849ea8657702d0cb53d

SHA256
159c4d4621f4ce1f4da14246401d85a00b40c0090fd0b2640446a896127ac646

SHA512
c844f9e5ba72eddc6aca73e09214bf8372ee5676124077983b78b10b9830a5e5eabd9c9fff2650858836f995ea79b1f0502609a428797b838ac7cda3f627c0da

Download Submit
C:\Windows\Temp\SDIAG_c45bcee4-c058-4ddc-81a6-da08f8044ca7\en-US\DiagPackage.dll.mui

Filesize
4KB

MD5
2ad9d1abe41ad048186f196b58fd8e9a

SHA1
d9c66f6ef89ad126ef2bbb36e0bcf6fc8a0e34af

SHA256
9b9acb69e01f79160d368cdcd8a4dc81f18da6398f920b6f663938171f5f718c

SHA512
4c4e1e5bbe173dfd37c65fff64a029883b2f719a360a9f5ee0772b304a518839605528b97b1ac0319b79a6d7f284767ad6c04b3b769559e2b14600c467947d61

Download Submit
memory/4048-1380-0x000000000C5E0000-0x000000000C5EA000-memory.dmp

Filesize
40KB

Download
memory/4048-1381-0x000000000CBA0000-0x000000000CBC6000-memory.dmp

Filesize
152KB

Download
memory/4048-1363-0x0000000007B90000-0x0000000007B98000-memory.dmp

Filesize
32KB

Download
memory/4048-1376-0x0000000007710000-0x0000000007718000-memory.dmp

Filesize
32KB

Download
memory/4048-1361-0x0000000006F40000-0x0000000007102000-memory.dmp

Filesize
1.8MB

Download
memory/4048-1359-0x0000000000180000-0x00000000021D6000-memory.dmp

Filesize
32.3MB

Download
memory/4048-1377-0x000000000AAE0000-0x000000000AB18000-memory.dmp

Filesize
224KB

Download
memory/4048-1378-0x0000000007770000-0x000000000777E000-memory.dmp

Filesize
56KB

Download
memory/5952-1899-0x0000017096D80000-0x0000017096DA2000-memory.dmp

Filesize
136KB

Download