meduza | e6a7f8e9092115954fd820563d2888d4fc7a699186b87c41737c6bf4cf8d1952

Analysis

max time kernel
450s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wild Reborn.7z
Size

47.6MB
MD5

ccb8604309826c5ef39da9da9843e6e7
SHA1

fb4fc3b201bcc2dfca10bff71044d36e60e1308b
SHA256

e6a7f8e9092115954fd820563d2888d4fc7a699186b87c41737c6bf4cf8d1952
SHA512

28818c22cdda3bb0a468ce2a9b779006c92406240dc91117fee1605a345bcbd7ff892046e8d79e8bc2cfff9df59ac00596caa575eaeddbb5e92796ee5af586f8
SSDEEP

786432:6OTMKVpQxry3X/8j+j2O7EvBieLFktx9t4CL0s1zkdCu076HssrgQ4ymPeGikXee:6OTMKVpB3X/8jAN7EEeCdt6mMCuyNxyQ

Score

10^/10

meduza 5 collection defense_evasion discovery execution persistence spyware stealer

Malware Config

Extracted

Family

meduza

Botnet

77.239.119.53

Attributes

anti_dbg
true
anti_vm
true
build_name
5
extensions
.txt; .doc; .xlsx
grabber_maximum_size
4194304
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2112-3256-0x0000000000400000-0x0000000000526000-memory.dmp	family_meduza
behavioral1/memory/2112-3257-0x0000000000400000-0x0000000000526000-memory.dmp	family_meduza

Meduza family
meduza

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
1956	powershell.exe
844	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x0006000000023258-3204.dat	net_reactor
behavioral1/memory/2444-3219-0x0000000000DD0000-0x0000000001058000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	Wild Reborn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	rem1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	VC_redist.x64 - (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	VC_redist.x64 - (1).exe

Executes dropped EXE 21 IoCs

pid	Process
2448	vcredist_x64 - (2).exe
4716	vcredist_x64 - (2).exe
2128	vcredist_x64 - (3).exe
4920	vcredist_x64 - (3).exe
4596	VC_redist.x64 - (1).exe
3420	VC_redist.x64 - (1).exe
4708	VC_redist.x64.exe
2228	Wild Reborn.exe
1544	Wild Reborn.exe
1104	VC_redist.x64 - (1).exe
1508	VC_redist.x64 - (1).exe
4368	VC_redist.x64.exe
4272	vcredist_x64 - (3).exe
2444	vcredist_x64 - (3).exe
4228	vcredist_x64 - (2).exe
1528	vcredist_x64 - (2).exe
5084	Wild Reborn.exe
2444	rem1.exe
2916	rem2.exe
2112	rem1.exe
4672	Lightshot.exe

Loads dropped DLL 8 IoCs

pid	Process
4716	vcredist_x64 - (2).exe
2848	vcredist_x64.exe
4920	vcredist_x64 - (3).exe
3420	VC_redist.x64 - (1).exe
1484	VC_redist.x64.exe
1508	VC_redist.x64 - (1).exe
2444	vcredist_x64 - (3).exe
1528	vcredist_x64 - (2).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64 - (2).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64 - (3).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64 - (2).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
226	api.ipify.org
227	api.ipify.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5312	powercfg.exe
5496	powercfg.exe
5504	powercfg.exe
2612	powercfg.exe
4160	powercfg.exe
3200	powercfg.exe
4420	powercfg.exe
5480	powercfg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File created	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File created	C:\Windows\system32\vcomp120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rem2.exe	Wild Reborn.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Lightshot.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File created	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2444 set thread context of 2112	2444	rem1.exe	188
PID 2916 set thread context of 1656	2916	rem2.exe	214
PID 4672 set thread context of 5320	4672	Lightshot.exe	246
PID 4672 set thread context of 5680	4672	Lightshot.exe	249
PID 4672 set thread context of 5908	4672	Lightshot.exe	252

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E40.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64	msiexec.exe
File created	C:\Windows\Installer\e580f79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\e580f41.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID217.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580f2e.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580f66.msi	msiexec.exe
File created	C:\Windows\Installer\e580f8e.msi	msiexec.exe
File created	C:\Windows\Installer\e580f37.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64	msiexec.exe
File created	C:\Windows\Installer\e580f78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e580f79.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120jpn_x64	msiexec.exe
File created	C:\Windows\Installer\e580f53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9ECF.tmp	msiexec.exe
File created	C:\Windows\Installer\e580f2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEED8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9338.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3304.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64	msiexec.exe
File created	C:\Windows\Installer\e580f41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64	msiexec.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1212	sc.exe
548	sc.exe
2404	sc.exe
4084	sc.exe
4368	sc.exe
3112	sc.exe
2620	sc.exe
5220	sc.exe
5376	sc.exe
760	sc.exe
1716	sc.exe
3624	sc.exe
4012	sc.exe
2236	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2444	WerFault.exe	186

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64 - (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wild Reborn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64 - (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64 - (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wild Reborn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64 - (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rem1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64 - (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wild Reborn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rem1.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f001e243b75cf490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f001e240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f001e24000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f001e24000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f001e2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34\52C64B7E	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\DisplayName = "Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	vcredist_x64 - (3).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\ProductName = "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Version = "201367256"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C05586832351A613E9FF58906A9EF297\AB297010A1550CA37AFEF0BA14653C28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	vcredist_x64 - (3).exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Version = "12.0.40664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\PackageCode = "1553588F03D4A6D43BA639FEDAE4EE30"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\PackageCode = "0F1976868EAF8784585CF1DB265C6A81"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	vcredist_x64 - (2).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	vcredist_x64 - (2).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB297010A1550CA37AFEF0BA14653C28	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C05586832351A613E9FF58906A9EF297	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{5af95fd8-a22e-458f-acee-c61bd787178e}"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	vcredist_x64 - (3).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\Dependents	vcredist_x64 - (2).exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
1384	7zFM.exe
1384	7zFM.exe
1384	7zFM.exe
1384	7zFM.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
5048	msiexec.exe
1384	7zFM.exe
1384	7zFM.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
2228	Wild Reborn.exe
1384	7zFM.exe
1384	7zFM.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe
1544	Wild Reborn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1384	7zFM.exe
4260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1384	7zFM.exe
Token: 35	1384	7zFM.exe
Token: SeSecurityPrivilege	1384	7zFM.exe
Token: SeBackupPrivilege	2548	vssvc.exe
Token: SeRestorePrivilege	2548	vssvc.exe
Token: SeAuditPrivilege	2548	vssvc.exe
Token: SeShutdownPrivilege	2448	vcredist_x64 - (2).exe
Token: SeIncreaseQuotaPrivilege	2448	vcredist_x64 - (2).exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	2448	vcredist_x64 - (2).exe
Token: SeAssignPrimaryTokenPrivilege	2448	vcredist_x64 - (2).exe
Token: SeLockMemoryPrivilege	2448	vcredist_x64 - (2).exe
Token: SeIncreaseQuotaPrivilege	2448	vcredist_x64 - (2).exe
Token: SeMachineAccountPrivilege	2448	vcredist_x64 - (2).exe
Token: SeTcbPrivilege	2448	vcredist_x64 - (2).exe
Token: SeSecurityPrivilege	2448	vcredist_x64 - (2).exe
Token: SeTakeOwnershipPrivilege	2448	vcredist_x64 - (2).exe
Token: SeLoadDriverPrivilege	2448	vcredist_x64 - (2).exe
Token: SeSystemProfilePrivilege	2448	vcredist_x64 - (2).exe
Token: SeSystemtimePrivilege	2448	vcredist_x64 - (2).exe
Token: SeProfSingleProcessPrivilege	2448	vcredist_x64 - (2).exe
Token: SeIncBasePriorityPrivilege	2448	vcredist_x64 - (2).exe
Token: SeCreatePagefilePrivilege	2448	vcredist_x64 - (2).exe
Token: SeCreatePermanentPrivilege	2448	vcredist_x64 - (2).exe
Token: SeBackupPrivilege	2448	vcredist_x64 - (2).exe
Token: SeRestorePrivilege	2448	vcredist_x64 - (2).exe
Token: SeShutdownPrivilege	2448	vcredist_x64 - (2).exe
Token: SeDebugPrivilege	2448	vcredist_x64 - (2).exe
Token: SeAuditPrivilege	2448	vcredist_x64 - (2).exe
Token: SeSystemEnvironmentPrivilege	2448	vcredist_x64 - (2).exe
Token: SeChangeNotifyPrivilege	2448	vcredist_x64 - (2).exe
Token: SeRemoteShutdownPrivilege	2448	vcredist_x64 - (2).exe
Token: SeUndockPrivilege	2448	vcredist_x64 - (2).exe
Token: SeSyncAgentPrivilege	2448	vcredist_x64 - (2).exe
Token: SeEnableDelegationPrivilege	2448	vcredist_x64 - (2).exe
Token: SeManageVolumePrivilege	2448	vcredist_x64 - (2).exe
Token: SeImpersonatePrivilege	2448	vcredist_x64 - (2).exe
Token: SeCreateGlobalPrivilege	2448	vcredist_x64 - (2).exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1384	7zFM.exe
1384	7zFM.exe
4716	vcredist_x64 - (2).exe
1384	7zFM.exe
1384	7zFM.exe
3420	VC_redist.x64 - (1).exe
1384	7zFM.exe
1384	7zFM.exe
1384	7zFM.exe
1384	7zFM.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
1384	7zFM.exe
1508	VC_redist.x64 - (1).exe
1384	7zFM.exe
2444	vcredist_x64 - (3).exe
1384	7zFM.exe
1528	vcredist_x64 - (2).exe
1384	7zFM.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2228	Wild Reborn.exe
1544	Wild Reborn.exe
5084	Wild Reborn.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2448	1384	7zFM.exe	95
PID 1384 wrote to memory of 2448	1384	7zFM.exe	95
PID 1384 wrote to memory of 2448	1384	7zFM.exe	95
PID 2448 wrote to memory of 4716	2448	vcredist_x64 - (2).exe	97
PID 2448 wrote to memory of 4716	2448	vcredist_x64 - (2).exe	97
PID 2448 wrote to memory of 4716	2448	vcredist_x64 - (2).exe	97
PID 2448 wrote to memory of 2524	2448	vcredist_x64 - (2).exe	107
PID 2448 wrote to memory of 2524	2448	vcredist_x64 - (2).exe	107
PID 2448 wrote to memory of 2524	2448	vcredist_x64 - (2).exe	107
PID 2524 wrote to memory of 2848	2524	vcredist_x64.exe	108
PID 2524 wrote to memory of 2848	2524	vcredist_x64.exe	108
PID 2524 wrote to memory of 2848	2524	vcredist_x64.exe	108
PID 1384 wrote to memory of 2128	1384	7zFM.exe	117
PID 1384 wrote to memory of 2128	1384	7zFM.exe	117
PID 1384 wrote to memory of 2128	1384	7zFM.exe	117
PID 2128 wrote to memory of 4920	2128	vcredist_x64 - (3).exe	118
PID 2128 wrote to memory of 4920	2128	vcredist_x64 - (3).exe	118
PID 2128 wrote to memory of 4920	2128	vcredist_x64 - (3).exe	118
PID 1384 wrote to memory of 4596	1384	7zFM.exe	122
PID 1384 wrote to memory of 4596	1384	7zFM.exe	122
PID 1384 wrote to memory of 4596	1384	7zFM.exe	122
PID 4596 wrote to memory of 3420	4596	VC_redist.x64 - (1).exe	123
PID 4596 wrote to memory of 3420	4596	VC_redist.x64 - (1).exe	123
PID 4596 wrote to memory of 3420	4596	VC_redist.x64 - (1).exe	123
PID 3420 wrote to memory of 4708	3420	VC_redist.x64 - (1).exe	124
PID 3420 wrote to memory of 4708	3420	VC_redist.x64 - (1).exe	124
PID 3420 wrote to memory of 4708	3420	VC_redist.x64 - (1).exe	124
PID 4708 wrote to memory of 3936	4708	VC_redist.x64.exe	126
PID 4708 wrote to memory of 3936	4708	VC_redist.x64.exe	126
PID 4708 wrote to memory of 3936	4708	VC_redist.x64.exe	126
PID 3936 wrote to memory of 1484	3936	VC_redist.x64.exe	127
PID 3936 wrote to memory of 1484	3936	VC_redist.x64.exe	127
PID 3936 wrote to memory of 1484	3936	VC_redist.x64.exe	127
PID 1484 wrote to memory of 3780	1484	VC_redist.x64.exe	128
PID 1484 wrote to memory of 3780	1484	VC_redist.x64.exe	128
PID 1484 wrote to memory of 3780	1484	VC_redist.x64.exe	128
PID 1384 wrote to memory of 2228	1384	7zFM.exe	129
PID 1384 wrote to memory of 2228	1384	7zFM.exe	129
PID 1384 wrote to memory of 2228	1384	7zFM.exe	129
PID 1384 wrote to memory of 1544	1384	7zFM.exe	134
PID 1384 wrote to memory of 1544	1384	7zFM.exe	134
PID 1384 wrote to memory of 1544	1384	7zFM.exe	134
PID 1384 wrote to memory of 1616	1384	7zFM.exe	136
PID 1384 wrote to memory of 1616	1384	7zFM.exe	136
PID 3412 wrote to memory of 1560	3412	chrome.exe	138
PID 3412 wrote to memory of 1560	3412	chrome.exe	138
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139
PID 3412 wrote to memory of 4896	3412	chrome.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rem1.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:340

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1176
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1844

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2668

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2776

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2664

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3400
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Wild Reborn.7z"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\7zO8651C397\vcredist_x64 - (2).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8651C397\vcredist_x64 - (2).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\7zO8651C397\vcredist_x64 - (2).exe
      "C:\Users\Admin\AppData\Local\Temp\7zO8651C397\vcredist_x64 - (2).exe" -burn.unelevated BurnPipe.{E643DDE2-C7AB-4F0C-8F49-27F4C44764B8} {7150A345-D07A-4E3A-97EB-9121AB7F278F} 2448
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4716
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{53188FD3-E1E6-4372-9D8A-5E2E7EB37C6F} {96928A7E-7A07-4FD6-B822-814F30B34A0B} 2448
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{53188FD3-E1E6-4372-9D8A-5E2E7EB37C6F} {96928A7E-7A07-4FD6-B822-814F30B34A0B} 2448 -burn.unelevated BurnPipe.{88F42517-FAEA-438A-BDC1-0EC16C894263} {958BCB3A-0DCF-4FD7-8210-AD838DD7F6EB} 2524
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2848
- - C:\Users\Admin\AppData\Local\Temp\7zO8654B818\vcredist_x64 - (3).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8654B818\vcredist_x64 - (3).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\7zO8654B818\vcredist_x64 - (3).exe
      "C:\Users\Admin\AppData\Local\Temp\7zO8654B818\vcredist_x64 - (3).exe" -burn.unelevated BurnPipe.{FBD1CDBC-25A5-4C78-A2B0-3B466A6DF211} {CE735E1F-09D1-4662-9E9A-9E65A302F226} 2128
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Users\Admin\AppData\Local\Temp\7zO86559438\VC_redist.x64 - (1).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO86559438\VC_redist.x64 - (1).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\Temp\{A9720D04-CD2A-4DDB-96B1-CD1A08A4300B}\.cr\VC_redist.x64 - (1).exe
      "C:\Windows\Temp\{A9720D04-CD2A-4DDB-96B1-CD1A08A4300B}\.cr\VC_redist.x64 - (1).exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\7zO86559438\VC_redist.x64 - (1).exe" -burn.filehandle.attached=572 -burn.filehandle.self=680
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7EC4874E-5A0D-4F8A-926D-DEE00E78E6F9} {DE439D5C-DC40-4518-ADCA-0FB666F62B21} 3420
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4708
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1056 -burn.embedded BurnPipe.{A8C9163D-1A1C-4EE5-916C-D5CA321127FB} {AD67BD6A-F751-4123-A892-CDD02A6CFA1D} 4708
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1056 -burn.embedded BurnPipe.{A8C9163D-1A1C-4EE5-916C-D5CA321127FB} {AD67BD6A-F751-4123-A892-CDD02A6CFA1D} 4708
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E5F611E7-3C84-42AE-8FE3-96EB2E030150} {356AAB02-F308-47E8-9300-DE5677BEA2A6} 1484
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3780
- - C:\Users\Admin\AppData\Local\Temp\7zO865474E8\Wild Reborn.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO865474E8\Wild Reborn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\7zO865B85A8\Wild Reborn.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO865B85A8\Wild Reborn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1544
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO865127B8\Инструкция.txt
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\7zO8655FEC9\VC_redist.x64 - (1).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8655FEC9\VC_redist.x64 - (1).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\Windows\Temp\{11D0BC44-1893-4A4B-940F-6555C78ED787}\.cr\VC_redist.x64 - (1).exe
      "C:\Windows\Temp\{11D0BC44-1893-4A4B-940F-6555C78ED787}\.cr\VC_redist.x64 - (1).exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\7zO8655FEC9\VC_redist.x64 - (1).exe" -burn.filehandle.attached=572 -burn.filehandle.self=680
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1508
    - - C:\Windows\Temp\{B718385A-F7ED-497B-BE9C-453D76D4F794}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{B718385A-F7ED-497B-BE9C-453D76D4F794}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C26ECA3E-BD04-4D10-B822-BE685BE5E7ED} {9DB9E77E-3B1E-4163-86D1-55911AA9FA20} 1508
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4368
- - C:\Users\Admin\AppData\Local\Temp\7zO86523889\vcredist_x64 - (3).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO86523889\vcredist_x64 - (3).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\7zO86523889\vcredist_x64 - (3).exe
      "C:\Users\Admin\AppData\Local\Temp\7zO86523889\vcredist_x64 - (3).exe" -burn.unelevated BurnPipe.{FD78CA48-3E63-4A8F-A0FE-DC502235E9C4} {603BB11A-4671-4888-AF48-2F1F55BF6B07} 4272
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2444
- - C:\Users\Admin\AppData\Local\Temp\7zO865A2699\vcredist_x64 - (2).exe
    "C:\Users\Admin\AppData\Local\Temp\7zO865A2699\vcredist_x64 - (2).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\7zO865A2699\vcredist_x64 - (2).exe
      "C:\Users\Admin\AppData\Local\Temp\7zO865A2699\vcredist_x64 - (2).exe" -burn.unelevated BurnPipe.{AFA72854-969D-4482-837C-08389EDF809A} {51CCE262-717E-4732-BF7A-C224667A596B} 4228
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff85c20cc40,0x7ff85c20cc4c,0x7ff85c20cc58
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2196,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    PID:1404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2488 /prefetch:8
    3⤵
    PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3340,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3084,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4760,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4992,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4612 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3424,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3404 /prefetch:8
    3⤵
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4936,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4076,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3344 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5188,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:2376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4860,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4908,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4576,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5428 /prefetch:2
    3⤵
    PID:2720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5260,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:3604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5068,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5520,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5200,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4496,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5876,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4692 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1120,i,13544833724399593887,4047626557870193631,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:1700
- C:\Users\Admin\Desktop\Wild Reborn.exe
  "C:\Users\Admin\Desktop\Wild Reborn.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\yzn.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2336
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dyeptwtd\dyeptwtd.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D1A.tmp" "c:\Users\Admin\AppData\Local\Temp\dyeptwtd\CSC816D5A6A61ED4991A3BB709722D35.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
- - C:\Windows\SysWOW64\rem1.exe
    "C:\Windows\SysWOW64\rem1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\Windows\SysWOW64\rem1.exe
      "C:\Windows\SysWOW64\rem1.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      outlook_office_path
      outlook_win_path
      PID:2112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 812
      4⤵
      Program crash
      PID:2220
- - C:\Windows\SysWOW64\rem2.exe
    "C:\Windows\SysWOW64\rem2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2916
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4484
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1728
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4084
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:760
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:4368
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:1716
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:3112
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:2612
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:4420
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:3200
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4160
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:1656
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "GeekBrains"
      4⤵
      Launches sc.exe
      PID:3624
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1212
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "GeekBrains"
      4⤵
      Launches sc.exe
      PID:2236
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3372

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4536

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:1072

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
  2⤵
  PID:2528

C:\ProgramData\Screenshots\Lightshot.exe
C:\ProgramData\Screenshots\Lightshot.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:4672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3784
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2584
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3092
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:548
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5136
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2620
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5232
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5888
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5608
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5560
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5764
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5320
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5680
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:5908

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e580f31.rbs

Filesize
18KB

MD5
4cb387130b468baa93c5dbcc33ff90ee

SHA1
aaa4e5afe0513a68f2d0ab1135398d446a74563c

SHA256
7cb7073580547d064e925b82c23a354188bfb949d51efbe2835dfa0d7bd1b05c

SHA512
07c640c646378acffeb50ba732e9f45e76ad1d41418116f57975e492bd3fed5a3f616a6d975ba97493e3000d754cba927521ece12eca0678b4c65b0cedfc8303

Download Submit
C:\Config.Msi\e580f3a.rbs

Filesize
14KB

MD5
5ca5b26e2e516a7b53fae1199101703e

SHA1
95a422163ada5d9f2f5daa4c4c6579a7c650c5c0

SHA256
08d379185c6c89695d6b02a0de62f1f9936cd4a4729028bc24f6a1914ed2a61a

SHA512
fb67894be7acd14924daa981c85cc8769315ccc130abdc774168e5e7c4b913abdf23430a686c44f2ac1b8a0e651fbf64ffbed3938e66b384287bf3d40422ebb5

Download Submit
C:\Config.Msi\e580f3b.rbf

Filesize
644KB

MD5
edef53778eaafe476ee523be5c2ab67f

SHA1
58c416508913045f99cdf559f31e71f88626f6de

SHA256
92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

SHA512
7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

Download Submit
C:\Config.Msi\e580f3c.rbf

Filesize
940KB

MD5
aeb29ccc27e16c4fd223a00189b44524

SHA1
45a6671c64f353c79c0060bdafea0ceb5ad889be

SHA256
d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

SHA512
2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

Download Submit
C:\Config.Msi\e580f3d.rbf

Filesize
470KB

MD5
f0ec8a3ddf8e0534983a05a52bce8924

SHA1
5f6d0265273f00ffe8e30cf507f0d05d330ff296

SHA256
88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b

SHA512
d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb

Download Submit
C:\Config.Msi\e580f3e.rbf

Filesize
348KB

MD5
ea1e99dec990691d41f938085f68bcc7

SHA1
5fdcbcd777e10e765d593994dc66f930c1377b0e

SHA256
1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc

SHA512
e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8

Download Submit
C:\Config.Msi\e580f3f.rbf

Filesize
134KB

MD5
d7dbc7c92177837431ae2fd7fb569e2c

SHA1
c26140204a6db421842ad36599326a5369fd1b5d

SHA256
22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70

SHA512
4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8

Download Submit
C:\Config.Msi\e580f40.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e580f44.rbs

Filesize
27KB

MD5
4f20aed5bc0482fb121bfa0b24c4401f

SHA1
34cb03ee29fea55c0316e9dd0cdc1faf0aace262

SHA256
f274ddc3eba095a56bf220790b5f360e86963a7b2d5d4c6dd0f36a3683ce1640

SHA512
838f75d49aebf8e5bfa68c1ce115220cef35d972919641c1cc36863e7a947981c4c47eb6a24f87ba848f9a247dadbd0426dca6ff576f50009afb73bc794064ee

Download Submit
C:\Config.Msi\e580f56.rbs

Filesize
22KB

MD5
97129e18f4484790b83a6254fc1307b6

SHA1
e01a5d769e166ecaf38f402a3209a0870a69e258

SHA256
121eb9ed446042a3fc2f4f6b69974fff5bedec087793bcca32b89f54882610e1

SHA512
9e6ebbfc3469435d9ba51c239f6603905dc49eef04865435d580fb5e84da21c5b057360c4bd52806477c214181092101fe622dbe921c1f355638905c1a054cec

Download Submit
C:\Config.Msi\e580f57.rbf

Filesize
45KB

MD5
f96a9a88487a27de7b3e15c733cf1fe1

SHA1
0a4157f064349b0370b8ee3f244f44debd04b4c0

SHA256
cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61

SHA512
df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b

Download Submit
C:\Config.Msi\e580f58.rbf

Filesize
45KB

MD5
6a5e17d5a4b24e5c2b947a343a182949

SHA1
ddf5ed505953e073f09b17e8e2bdecf2766c6a4b

SHA256
0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e

SHA512
8a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97

Download Submit
C:\Config.Msi\e580f59.rbf

Filesize
73KB

MD5
bfc853c578252e29698ff6b770794e6a

SHA1
1091dced7b18bdd7eda2be4d095ac43cfd342b7d

SHA256
80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6

SHA512
306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb

Download Submit
C:\Config.Msi\e580f5a.rbf

Filesize
63KB

MD5
19b7b852ac2dec695e6a52801e59c421

SHA1
cd72265e1a6a64c761984980895d92cb93bc61b7

SHA256
e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6

SHA512
d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017

Download Submit
C:\Config.Msi\e580f5b.rbf

Filesize
72KB

MD5
9ef2dc352d20b615a556be53b449b17c

SHA1
933b2a39f3d730c6b5d437558d0db68c5d2c22b7

SHA256
db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120

SHA512
8031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91

Download Submit
C:\Config.Msi\e580f5c.rbf

Filesize
73KB

MD5
06473191b67c8b3d1a26b76474c5daeb

SHA1
94c72bb597c365cb77f621e6e2cf3920954df2d7

SHA256
e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7

SHA512
237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb

Download Submit
C:\Config.Msi\e580f5d.rbf

Filesize
71KB

MD5
713e30e13c1998e035cf4ace66b03230

SHA1
2d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5

SHA256
9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10

SHA512
8a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a

Download Submit
C:\Config.Msi\e580f5e.rbf

Filesize
52KB

MD5
689b5f0061a67ac95f59a64744702186

SHA1
52227dd2c8a66c0528bff28475846faf7036340f

SHA256
83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b

SHA512
30b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42

Download Submit
C:\Config.Msi\e580f5f.rbf

Filesize
52KB

MD5
7d03ffc6a8fb686abd660efdc3aaf223

SHA1
3d04c53971a525cc3255ff1eab05ff0cbad75bb7

SHA256
b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9

SHA512
b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1

Download Submit
C:\Config.Msi\e580f60.rbf

Filesize
69KB

MD5
a99ad214ccd1e7bc1f609b972467b0ca

SHA1
9ee79954fdb2338026c3c81da00ab6e7e6c2e1ff

SHA256
3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983

SHA512
da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083

Download Submit
C:\Config.Msi\e580f61.rbf

Filesize
5.4MB

MD5
ee4af4ceb4b7fded7cdda37faef69704

SHA1
5ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2

SHA256
75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c

SHA512
4f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece

Download Submit
C:\Config.Msi\e580f62.rbf

Filesize
5.3MB

MD5
a6d08e8e290c80822842015cd877d405

SHA1
2ee9d28e20a73facff20be87092e482b562dad41

SHA256
950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906

SHA512
b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2

Download Submit
C:\Config.Msi\e580f63.rbf

Filesize
89KB

MD5
43aae7bfb0c911e7e98003e2b45667e6

SHA1
0c6c7d96cd0eca734e425b1ddef178c3ab6c31ce

SHA256
a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476

SHA512
33d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9

Download Submit
C:\Config.Msi\e580f64.rbf

Filesize
89KB

MD5
0d5451a0050f7acc970ca02459c63d9a

SHA1
2de9febca0b1d48014081907e835237c832c65b0

SHA256
864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e

SHA512
4d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8

Download Submit
C:\Config.Msi\e580f6b.rbs

Filesize
19KB

MD5
b6e20c7557a19b7fb365ec4b4be91f53

SHA1
1dc18071a8d0fe468d645ef3d1647d9e0075014f

SHA256
502d926ff5b5b79b783b54f09cdfc7033aacb15f3db3d18804771f157f9656b0

SHA512
47ba29c2cd093be2a01cf4d035fda8d9b1287fd6a6d1f9aace1aebf4d7ab4df29f7d8514634404f58d710b8916b1b09da1d20ca0694a9f3f1e57965903879407

Download Submit
C:\Config.Msi\e580f77.rbs

Filesize
19KB

MD5
44c39b776824ad1e8783ef791d4772ee

SHA1
ca8d5814c37e12d93a74f9f665f847f6b75dacb7

SHA256
64e6982a19dd0fdd1a44aa2709ee1dd4350d4c2281afefe48c8ae1d47a158bd3

SHA512
923a91a0289ac86b50e892cc547c03f90d86644969d2dadf60dd6ab1c086080518dc60c665aaec5f8391dd163da00f91858adf3adf62b7a31bbb88584639309b

Download Submit
C:\Config.Msi\e580f7e.rbs

Filesize
21KB

MD5
9aa802ac731a8387cf8664c24c33d2d1

SHA1
da8bf91f5a5dcfb192eacba16a557c00a950d1cb

SHA256
dea4270b8f013f77261840fa9fb6094a7ac8f6439d05ec7aedd6e5190faeb1a4

SHA512
67d6c7cf52a47e1a6c19ceeda9443715169d50678bbf287544f251491112cb0e07d0dd5f8f0e76426cbaf9d315c0d9a067dfcc093047a7c8e7dd29d24925c2a0

Download Submit
C:\Config.Msi\e580f8d.rbs

Filesize
21KB

MD5
e9c0f9c4a7c3df78d8701a611d961c85

SHA1
02da0e83eda77a305937489fb48ac9048c3df584

SHA256
e9045ddb470e40dcb58a7be972e2d1374d99d752a83c3fdf363ad12e2ebb3ec3

SHA512
4954b1c60a0644b969582e17c2b0996e9fb7e341ee8c4304b17c8cb66b646a931d78b437bb3b9f56026c81c5d0a431116dc3b49b73114d20012269e2582949a8

Download Submit
C:\Config.Msi\e580f91.rbs

Filesize
15KB

MD5
e63be41ccb8e6731284015cf793c29b4

SHA1
d2a04b01a55a0c362ddcf80fc9c449fc143cdc59

SHA256
c6a4cc4e87f956e2ba3ef3e9487f527ebb48477e894631f611230e03e589f41f

SHA512
2c6db37d92ce1e24fc61c256c2c131a148fd77556dbbb3125fc3b39efa7735cb02b47609fe5ebee16ccc3eb5894b64b3c8fda598b55e751189c3f012bdc51050

Download Submit
C:\Config.Msi\e580fa0.rbs

Filesize
16KB

MD5
b45286cbb423a945624b5519f2bcd503

SHA1
62c3ca0d44c8b1e930f6630a27a28df2acf200cc

SHA256
fff95d30f492ec6c6e65f27811d980833d1fd1f213edc28ccd9171c603371dfa

SHA512
ba9c4329097228e9a750b54f860c8514600ca76288044c45c147ce8d010b916546474d40f210d8b9a0c32a27c40d71451dca9edd3c124bdb586e0faae38b1a96

Download Submit
C:\Config.Msi\e580fb1.rbs

Filesize
12KB

MD5
394384b8bab0a3e781edafb8ae174585

SHA1
cd8fb89681085520a22b76aaa5eeff5fab740ef0

SHA256
d470f50b73e64cf747d38f30c4d136363568f1fdceaf60a81aff559ee1c12ee7

SHA512
8e892706bf4caabafcd6d983d63738e89129753eec43c86bb5eefb46e3d81f8f807c2cbb515787f32a9329738436a5a954810e1d7f1abfda82b294f086382729

Download Submit
C:\Config.Msi\e580fb9.rbs

Filesize
16KB

MD5
83e60025248d89552631e676a86c83d6

SHA1
da7b69d6d6c14d1850e9d0499f45ea19635588a8

SHA256
6f065bbbec3418119bd39c6abbd77e66fa63a358cb0278457c1c864093b6edc1

SHA512
7b2dc9f383c64a171d2f8d3389dcfbb7fcd272de92b8f5259184ae523de76e3a7fd0c7d327ac6c0d31a1822a7698f06742d51eeb3959bcd87bbf32684977e72f

Download Submit
C:\Config.Msi\e580fca.rbs

Filesize
12KB

MD5
028c81d78fc694d34e18fdd12d18f7f4

SHA1
e89019e8f20e10d6041f3549b624ab386494d2ba

SHA256
9a543642f04874e96f33af159627bd5f12326c7eab3e3bf145717dfee31a3d0a

SHA512
ae1001b52eb5e841108c5ef31a559a6bba4ecd839dfdfce4702b8d94ab426e03b107986c29ac2625981ce969f2f95a963c69bf0de510c90d846a4d960488ce29

Download Submit
C:\Config.Msi\e580fd2.rbs

Filesize
16KB

MD5
9772de8cf11175af23f06d35022218ea

SHA1
065133974853c8a6350302240cb78304c3bcf40a

SHA256
219305da5e7f8aa26fc05ae4dc7d7fd12c8e77ffebbf783770eff456ba7ef2cd

SHA512
6f984e7aab78338e1ec02e61b7e5e1ceefcb8eaa14a7f948c83f77085544646ccabe978474eaf2497381ef72fa05d14da62963139f81c78e4e0f2306760896ae

Download Submit
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm

Filesize
734B

MD5
966c5c305e0e4e49e67bb4a004b217c6

SHA1
48266fc462865fc8769f6ecaf0f8cd60e5a2160d

SHA256
d2c77667de47a8632f1140b7a9aca0f6c32338d704738820eebe1383226fa931

SHA512
90b2aeee74c10f834a1b586e1614574fb4a1dbbf5e6342cfc831ef85829fb237eecfaad084551e2be162f2907e64d3f4e222c0c245ad38a70100337c1830ebc8

Download Submit
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm

Filesize
742B

MD5
50671d75fca76c3a5c8e64ab5f67e02c

SHA1
ad6353a719b2a1063bcee4ec509d85a508a74ee0

SHA256
5ffd652536c2ec3e1130fcbb5d435b0616a3444c12547f16f9c54f1bdcb32c6a

SHA512
8801621b344a3ffa401859e80536b6217701ca0d1129173ca20143b065958eab25a45f0786de6a790c2363598ff7e85430475a840c630952101557bab1378dd5

Download Submit
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\state.rsm

Filesize
976B

MD5
931ae017261a3f9b12d5c88de246ac7f

SHA1
a7579bcc4ef8e3aeaebb76548ceb6b3a93a2ef3f

SHA256
6c213027ebd3f6210627895af3045f8a646430261ed5d082ad9f915ea0b5c69d

SHA512
a8459f30fdd070bd5502b3b7bbf8d0c943fcd5a8c63b852a247635a5b32f76de16e394b5d464c090a7651bfd0a1220c6141df5de293ab61ddea11412059c5c9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c69caafa99e71f2d079520b35544884b

SHA1
ce41b90c7a241b114eb530a83e2da69fdc9c47a7

SHA256
74fb0a76ea3830264ef635c807ce744bbafd4926e878c35c85e666684fce76fa

SHA512
27e4f2aab87a105249e705a814fbeeb6643d2b9957742381ff0019a2c11fc63a388de75058d0614d963de153d1e0d3e0742b3a80a9e9217d5a03b9d609780510

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
50945d3285f295ba3cac076e5ccd3078

SHA1
38944f328a56f29c1dae24d7bc42269aa44c9672

SHA256
a199c36d15a2c6b9219e3c0e6d94bd4c97cf2ecb44319a6305f051751bf6f39d

SHA512
8dc5736022e1c8d038d8a29084bacd3c712d92b542e8ab7902661b68e3f0a1faa34961aa44ccfc7650e9246c91f6d63ec7848be780b0e989eb827ee50830273b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
7dca4dcf57e94fd1c77d3b511e1a6762

SHA1
f1ab376f7ec185b00e7761a6af17e4e8f0c423b7

SHA256
0b5f948414bc73575ed1de346567d8967f8e2641990ccc0936ac8576b381f99b

SHA512
f6eb5051087dd9491a143d6caf04e6bf089c01c025f9741fb5d32355a14b27846e6e90c503046fe90e8ef650f1ddeac4c02843e836a79ab95487a7ba0ac32d5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
d33b64a974c3c132a5de42688d336a6b

SHA1
b61bdfba9fec8e54538f3c190098bdda3e2b20d9

SHA256
dd443fbcdfef35646eae838d7d7a44fefe2817ee3635906442d99ddf7e6b26e9

SHA512
b1ab4908c8dea21f2f3d09cd317d98d719b26ca9eda07fe88bf9134e1d9ffc986ba6c7d98a1841479009c4c14bcec23065cc2f81b3c2116fc9c32a461e75c995

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
ea19c5b9576ebec8c7b0975c66a14ad9

SHA1
9dc4670b538660afddb259a39de03f280750c7f7

SHA256
8b62e16cf29af6817cf642ff0e39ece9defd98ed875a80010842d5baf22400e0

SHA512
b098f8edd412ec89aaea173053eb8915393cb0f3b228bdfde297fc518bc0dd3a23c55806822e29503300b11b6325e55add320820b477ee2882c74f70716c4b12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
58d8be1de6923d316b27df94ec91caf1

SHA1
a342e00ed19630028013113f25306e89de9c241e

SHA256
921b66e7c96451a073fece4c8be9d45cf7d19a1810b5541aed46807006e46fda

SHA512
fe47be7a6b20b963434a44cd4334d523795e7f8470adaa059b44759cc140fb4aa76a131f6ca46316968c61e5389f642a49b73165e44c4a8885c4a4d5a89a608d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e9a0825b61a47cedbfb19fe96cc51700

SHA1
a91fc0a98c84a4d2cc0401cb19696905af9de0f2

SHA256
4cde43bfd00b2b6892e3f7af6da87079da7b3e5845c1dcba25f6623c98eba889

SHA512
d683d175fcbf37c5c4fef342e5d4c4df7410027bd313259551fc09a59c62ae769ea2035a14af0491e413888ba7f172e23dad413835e36625c57254b3d761340b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
76d86fd9de76c82656704dae116d9005

SHA1
c9547679262b179e2af228cfa2fd39bb4516f6a6

SHA256
6ebe12dc1f3ba7ed5450febef6fdcff4237f2b8c1e70a6293704f8e4f7b883d8

SHA512
8be8e62d36b1c5e5d55d2b86a3992900a0200e8419f84ac3554676a19415669f4d507d21939e6f058cef49f571686ea5edc852dbff1fe9ac607aa81455853f72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
059577dac5963ae9e55e89740e34f41c

SHA1
bea22076247ce0c7d2ad9f1bb7f476920b132788

SHA256
88d8c7f58d30ac44c365b3fc4bf431896db5f25eee0cdd562598026e7281f92a

SHA512
4ad97c18a051eed1f4d883f9d3d67f4539f23cba7133030284cc30c0acbffdf628c51956d6821d15d7efbaed7851fc41e4caa6c545e4d9792ec4eb1df264e579

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e8f9e315226c0ab8b36f279dd858859d

SHA1
0ead22e96887f76db239e02cc65700c7eb83b751

SHA256
2611bc455ad3923948bd63c2a4b231da57d5179d8fac7c09336de46679948541

SHA512
7b30028ce02089baecc759b7e97aac9570250ee45bec81cd43cbe976502c3ca9d95cca0493bcb1eed045992899f070609f05dc98bbea1d15ccff6b22599cf7f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a3940d1ac7b93faeff05f9e5387341b9

SHA1
02aed29141a478db54ee4814ab1e20ea419dc56a

SHA256
06287055e8011be1cdb24f8d5d65281b1ff4752880084b3c327507663ccfe337

SHA512
6c44d334f7db3f2a7ed9ced271dbad7e15ba38277f517626b6f28a3e8feb49723c7622933789b7bc6d64d6dc7477432afd3de2c7477c9d5a0aebc41b77b9cc81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
dff1e1de81f83fd8f48b1244c125aa3f

SHA1
4db341faf17a1e8e8a4ea052bd09597e22764d1f

SHA256
abed5b1fe2bddc027b1e54c3e141610156689a98e0d16970bf94d2e663c3540a

SHA512
6d0fe3f009b3da742818079294d2a0a1acbbcbeb8928be0d5faabff7225d6e3c4e864d56ac216710af3cb8e5b428fd86f031151a5079c76fee29649e0b48d3b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f6754480cdbd1f4bba5ec1f025f47e71

SHA1
0d77f07cabbeb2dd768e23aeb2ff71bb6156f918

SHA256
957056e1e528ffed27c51ed1817c34d2f69cd4307987f954c53521ec8203db72

SHA512
c3a8a69177c85a0b15de23edc86967c91c6c58305702e9876e05bc70f581719442dc550ac0d3a00804408edad9ff6b85a083481e1530c58bc2cfefa212594a19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5cd63ba38ef1b56e1afcedceaeca2ca1

SHA1
ce2de459a3d9c6a86947f08f72aa57f759a4911b

SHA256
a9c7c3de64bf98a953bfe8147cd8faf4ec66a0cd2b301ecd4d39b2aa799f55b2

SHA512
277ce03b190fa3a3bbe25980b0d6448628390016f3d42a4d22d72e47edd1356dd93d1036bb83c42d2dbaaf250e14b950af0d27ff4b56b962a82c51dde2af9b87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
be9433d73bf2f676ed1dddd0b8374f03

SHA1
2197b6c503b83c2b2d1898530f3b9be337abb917

SHA256
a3d4d0c25134817ea23527ae558945c96a1af8b12a08cc3b07f7fb89f8cefe90

SHA512
856a0eb90d23cfe7e8f0105e4790a1ecc96f19da9651c79ed117d78814d7f202641249c16fd9e54b4274c61c1fd914e88916ca222ea2c63fc22db92b3a4a649a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4fee957c2a91791e66ab1e8018387fc1

SHA1
1c44c741fec4b851dbef6ab67b5d71aa24e5610c

SHA256
f37eac1b3574550e6e8c3e6ecdd89e77307a7c51da8db997dcb973b075c42f51

SHA512
d3d6540ffdd15d7e1818bc4dafb2a378afb1e5122edf36223347e5fd44393ca9b43b3e3f83352a57f4f7762337780cd246e261101f363e2cbf3d1ca63d6eaeff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6ebf315161ea812faf9de9600fa0bc1d

SHA1
2190cacd5044b255ee09fbfe935977918951742b

SHA256
487077c658e27fbfa494a753ec2fa11e76d0ac5a8e1576686e541e32d5754c88

SHA512
c2560030691f0490e61e79b4bb3eb8688bb684b4a7862b7b35bb8fe5e5a91839fb7966b7c1144d63e54ae8089fd98111eaf5b3cc81eb715ba8442e86365da77d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
783c68ddeb96b8a4a36cd0b8bacc7278

SHA1
3f4cbf94a249215ad1e80af808662c645497c831

SHA256
0cf4301fcd4827d3cb6c3ecf5c53e2251ccb0a9ab4815cce39b1bab98f0ba02c

SHA512
1c8ea5658bd76080e48ecb725546cca4a75458800f8f2ea4c98e9c93aea18860593dd474b4af133ebb4ae7da06bb52f08935d8d72fb9fe08db535f1d8d64881f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6bfef84607655650c7b5f0059891f73e

SHA1
adfcdc4edf188d874ff4e7dd5ee6902576faa826

SHA256
a70ab32cb2364d5346383dea822de3f6170981f388d44ba3ac7663d7890a57d0

SHA512
15a1542609428baa0eebb0ce38b223e3ed3c7fd08aa46bed5b1284feaaa8ccf168caecef1027877d00fd5268b28e85c4b3e37acebee1a9e96ba46036b5d208fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
efa56fda1af29d0e3d2d3c55ed5802de

SHA1
067b8b1bf568419e862316642ce8affed1f2600d

SHA256
b7eff0b20c8015111c8d6167a02e1db49b66f36681a68c06184d44eeb0b9f260

SHA512
e755cf2de6fdbbe4160e08f090201894bb9c78cd4c2eec6e4fa4b62e04eab1f21510788d6e83eff6e4d499962f8c4fd42b9987235d81f2a242e6b98d5884fe2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b2deb8e435f71ca45a871668cb129339

SHA1
130446f6c20f209212b80d78d23f85d4d8e3ab21

SHA256
7fa6aa9733467a4133e2eed27f1c5d8d9a8f173b5da1d78ce4137f8b82b0bf76

SHA512
a7ff8ebee41af17879da759ece11ac53380806c7d5ddecb2829328df523bc6fb74d23c5372dd33375b1928a6dc4003fc0fb7054df8ea343710e2478b18bc7d39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
22a8d56b7c80b5df1b246c92b4687b28

SHA1
45e9be25d1e426eb62335d18569e621eb215e5e5

SHA256
2f42e51d4c6b312154a2a42c38670f8ee5604abb1f895922eafe1b002c446903

SHA512
2c04bd3f72f12ce9b79708c9bdab5d196b244d060127b006315e9284a730ca275f476264c1add9e2249c0db3273ab837575290fe077abb5b5750f781bc15835a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
41cb310dca3d1a0cd76b1a85f1a72d9d

SHA1
99eb7e91093dfd816bbe39b9469e75ef2d28b3c0

SHA256
3f71a2ef562b4ab9bd607e6bb83129fa8cc7db77a5cdea73c38f49d8aaacfa79

SHA512
cdbe0a7e0c413ff6d906560ae32edf2b533d672b0f1844b47acaf0028de3aec7fc66e55ae642a669ea5509ff9ad66fe6382c4af51e07ffbc25cfd4c20a66a4aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cfe80015109d0ddce03d102492073ad5

SHA1
ab4ff30c4e46a736505b4e43ea0063c28e56f6e1

SHA256
25cb9ddbd7f2dff0153de02f080c26db86f173fba4855fc3c79b16dee9634b73

SHA512
ab491d59a2546c8538e4c1876d64127539d54397ff5796a441729dcb7621ba153acab76d638a05f8a3b01fe64d9aaa30101dae87d8e9672de6759711bb8a0c8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
518b395b02aa648cd21b542e590f9eb8

SHA1
a2b485b840ad07b5300db4f990af1add8ba38b67

SHA256
91a25a5612d4ee50368b33abbed230cab6b2f9e5065ffdc0298bc4152ecaa425

SHA512
da0de8d1ffc3f246a2c6d9e51dfb005fb1bba39c34db1b55d56eedb6018b4c0874c4abf379c11cb60ed46f0397f27ae724c1272082074974d38230c4876e0d19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8da30e7e1779c1888fd5780acda0befc

SHA1
afb4a28107b2163a7d6b06cf8b28e41cce205001

SHA256
2409bf18e030871aabb5710b6ebf9d67348c13e5465cbba06470ced29ed91a82

SHA512
ea7497d79bca8870c4624bdbaa1a82519a52c29b5edaf7b1b900dcdf2ed600de90ac8a9991c09a0d00eac1379f6d1c34da246c4fba9f9b72c0ae86fd0367e140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0b607521b7be415a0f0653697221238c

SHA1
d2e68fdc979edce217bc171e31de08048ceb261f

SHA256
835d3fdff54fe24cdc16da63c60ac267d70460d508f53d6669b115e343b2e818

SHA512
a77fe650d9dc3123f75445c3ed774d4c9823dfd844cef883cc62bcb110b77f069c3cbb779dad9364d164d7c4fda8f274e749b7abaf50f9db779b20e0fa210652

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2a8884c7693b06826bf7c623ce8383a2

SHA1
4711cde0c46fa93cce13a5e647ece80a9da70774

SHA256
32235a062b22178c431b8102793d6fced30e04daad78b59d48c9cae84623598a

SHA512
c14bd707b6dee99d73ff55140cbde9eacdb34476d7d9bd5529b9449cd145c1bbfcd7198e2b3e8a4174cf84e55534131b22c9cc6454abec0f6881a03703aa5f5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1e257aa24d88188f8c79e76227496d41

SHA1
c92339fc7ffd0fc673ee317a0cfab80bf05b9163

SHA256
f95672760281fdcc5457ff273058a2b232f3c9d8ead005524c404759d42082db

SHA512
f0dab8acf11c1ef0796518943c976d9883f1199e2ac810f282a18f3c383263ddb4d4243e2a6cc5e9fe21be39afd07895a11e895e88bad4401c0c03205b241df8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b3670dbc-e6ea-4b92-a753-b79db39f1197.tmp

Filesize
11KB

MD5
a508dd98984ae82f02c7df6111e61e16

SHA1
38803e95800af72e3bb813e6a06fd2c1623140ef

SHA256
fe126f91b07a4af192f6265022a3c10d5c72a219f329260688a0852d1415dac1

SHA512
3896b9374658422341ce85d1e54c0ac06c2b295a7618413242780d79594fbab7ed1b2ee5cef5fa7ff8cb1755dd25430847131d946bfc589aa02e4e29a49a996c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
3c0b3f4db60b338527ff23c3a1664ba5

SHA1
8e70739ee39457b378029d0fb822e581cb70b2f0

SHA256
ed9999d7d2dca3e5797d7060ceb8fda6540d7828b97d64591c7d0ca7985d10c5

SHA512
66e29873aaf4002ac9bcf3534c339793ed8dd0a78cc289bdb57ee7292a1fb7e7382516f56e2af8d081d88ee40dfb7e3fccd4d6fbccb8a9f2bb13fad44ee84e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
39d2c67ddadb5497d90c8aa0f609a2ee

SHA1
5898170768233d11e667234f47dbcd186c1b8c8f

SHA256
c7d390334051412a2a12644515dc1d84a4255aa5319cec1115923930d02718b4

SHA512
9a7e284eb3366df4a0130e51cfef0be89c303894b876ee83c0c6a27e8475c026160b7800ed2d7b91360d64b6b00f8fc17c9b5fa9d78911ce7b27488c36667449

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
b7248230b9364faadebc756e7448b821

SHA1
6707b54392bdfcfce64e8d8cab2eca24e492df29

SHA256
7aa1b4ac7514c91c902637b8f156e78a1d470d9a44bb09dbc8f971846bba59a4

SHA512
fa947532f7c128ceb50f7da421748b2d170043f2342ed9e56cd0723c8dc22fe73689a548c95e1d99fc47c8d22082bc9d83329412dfd504eb54d31a3a134feb76

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO865127B8\Инструкция.txt

Filesize
360B

MD5
9f4ae12f3a31a749f7e1ca9e9e589f78

SHA1
0322a3d4a923c143782ab45fab052e4668825a51

SHA256
58bd5e021e6979a26da338146339e0c817576a0221622e9c83882731973ed2da

SHA512
88525f62697c17b61bad8bf1597cd5a149cf32faea81aee78f778cfd624fa3c7e0f8b9e2ec71c826712dfd87cc4635ce9ce4a1d79cd06bfd37c28b97b76c8fe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8651C397\vcredist_x64 - (2).exe

Filesize
6.9MB

MD5
49b1164f8e95ec6409ea83cdb352d8da

SHA1
1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

SHA256
a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

SHA512
29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO86559438\VC_redist.x64 - (1).exe

Filesize
24.2MB

MD5
1d545507009cc4ec7409c1bc6e93b17b

SHA1
84c61fadf8cd38016fb7632969b3ace9e54b763a

SHA256
3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a

SHA512
5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqfijlgb.cwe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250302155801_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
131c031f0ff4feb2ce6c7369793abd9f

SHA1
cbc995d6ccea13c0146ca22456105750b41d39c3

SHA256
796e60707e3340c3fb5b36a0a4052fe66c336a97234b82db170ce9f9d3f5a05d

SHA512
514ac4accf3ddf0bef1be7db419698dd26ec76eee6112f6913b5f76602e629c413efbc9fb333153ce940b8f482337eb452d3db74207851c03cd07240bf9d0cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250302155801_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
e2c5d2ead31e86d32f00b91c0bc4ee9e

SHA1
0f2831c1311f55346e8071969e6f63814b77ce4e

SHA256
7f0a3b3c9fe5eab1fe1f4a6ac9c057ed7d5c729ce644908c65a094426d36760a

SHA512
3153880cb5a9086b4206b3b98d23e9024121715c772fbfd22d581d31f9bf744175a319c2eb8ba7ad83973d20dff6fbd9370deb1e44b431f084f8ad036240f8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250302155842_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
7be336a252e1ef3291ef9ee8e9a30b71

SHA1
af572dc1139c38717afceb197dc387a206c64e8e

SHA256
23ff3c373d5722714252e0a7916ed42d01a89603cd752488908b938d4b57b11d

SHA512
dc7405260ed0eea7a0c2a6bfbe35c00dec101cb8669b3fde892aa1c2c96dbf1428830fa05f020db378a97f258cbf09157ca01dcecf2d8832796e1e4643a87662

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250302155842_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
736a4167d0d705332d655e794d6e9124

SHA1
83e9c5ab41d6446a9c70db0690dfb025c01b0929

SHA256
5e6b8a10cc50ff6885b31a17881e56c6c3e9a7b44d8ee8c23b60ba500175275d

SHA512
67a9c38182bb1e6c7afb801cb9d389170537345b975bc345936d5c9632a9690bbfeaa950bae06997a9d5d422a598db78eb6b19cf619d10f0addcdd21d6cc2c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7365f71-ea29-4aec-869a-5e62fda4729e.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3412_387846479\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\BootstrapperApplicationData.xml

Filesize
5KB

MD5
d1439b6cfe105425bcce1a81954b3417

SHA1
288e59bd999dcfed5c4c746c1992cfc9bb5f2380

SHA256
3ae340bec4fb68b477f34dbeadaf8cf3ea95550e427a3bb84994b5806485b5b3

SHA512
868a9c1706b967f532039f9413bbde8ba0fca5cf76915334c1a1be7d0513d3815f506a766183d85d3595af2b4928cf5f3ad16703d20b2a5caa9c9c47b4880086

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf

Filesize
6KB

MD5
1e47ee7b71b22488068343df4ce30534

SHA1
deaee13f21ab70b57f44f0aa3128ec7ad9e3816a

SHA256
8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13

SHA512
c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe

Filesize
455KB

MD5
3284088a2d414d65e865004fdb641936

SHA1
7f3e9180d9025fc14c8a7868b763b0c3e7a900b4

SHA256
102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6

SHA512
6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.3MB

MD5
f5879f5f3ffa839a280ab853338de872

SHA1
3b4366abb2da245416531925ebd8c76adc3e90ef

SHA256
1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174

SHA512
96a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503

Filesize
1010KB

MD5
361903c5ff86511786d7b450301dd640

SHA1
c9fc04a718a388294658590f1240d8c7e9ee4f82

SHA256
e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433

SHA512
78ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64

Filesize
140KB

MD5
4f782799f84cd006f7f1c750afb04d8c

SHA1
0cd219d326fd40665d2f1b22569e2517792edfd9

SHA256
8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc

SHA512
cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64

Filesize
140KB

MD5
87b74c694f295830ffe516ba20de0b93

SHA1
e6996d47bb76ad25954b793f73211524490f55a9

SHA256
e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816

SHA512
d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb

Download Submit
C:\Windows\SysWOW64\rem1.exe

Filesize
2.5MB

MD5
a5b3e3055d6172330de1ed4af03796d2

SHA1
5444cc3bbe04c417611401e049dd413edb35c55c

SHA256
d63c5a58e86027ba6b208fe148ba6580b89b408d9cc39ffeda55977273ccba43

SHA512
b4173731454cbc9c39418d153434c38d67e417de204d79d257d6a8b3968d19738fcc72f666372980e839316e0a37af1fb6b9023e84c71ee833c32eb4b9cbb46d

Download Submit
C:\Windows\SysWOW64\rem2.exe

Filesize
2.7MB

MD5
990a3f3b1273510f210fb9b541da219f

SHA1
33e536c5b4bdb6f6042f93445dffd8a3ad488e8b

SHA256
35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c

SHA512
495734313cae980d3f48ef78422cf9484eb347833672fd5c693f8f8c92c1c0d51986795cd55a3148be18ff0c9d36adff5a1c3ff18200668dd33f3978a459c246

Download Submit
C:\Windows\System32\concrt140.dll

Filesize
315KB

MD5
43368859a510340fce406357fae7ccc8

SHA1
e86a4a714b728b3ae732270551bba941a3700868

SHA256
4f500992a53c41a0ba44a11c33c481d8763505a7453be12d85107856ab8fb332

SHA512
6e95d9909346a2cd2af6fe4ae9ba94e5377888988f280bf9e123f250b37e636ed35371a3ccae4e6227da6627357374a636a394148da445bafa190408ccdaf71c

Download Submit
C:\Windows\System32\mfc120.dll

Filesize
5.3MB

MD5
47999145f1b48d94e732420a5f3e405c

SHA1
29a8a95c4f8824ccd7bc14cc4cada0545a8dfef1

SHA256
fb83e940b281947cc8659611ef6afa75c21a6626b1e70565d0a573f22a48b55e

SHA512
f13a52e9444aee274092be544c8558ed1bdf58046c983af49815c6d75c4fd41a361917f3cfc07b3fcaea69a628d23e7684e4be939904ce473fc9a4d771355733

Download Submit
C:\Windows\System32\mfc120chs.dll

Filesize
45KB

MD5
7f9a33deccbdb7e47c8ab3b748ec4144

SHA1
88a78f8494489cc12907f530860b3299304db1fc

SHA256
64920e61862e4feeaf321d2a3f80eab3438e8cde38089dbd6ae1ad045f750b2c

SHA512
67b329cf7d6aaa3c4ddbb02087f8bcc5b032687f616c8a4a4031fc7f38dc00dd43e96b98ae7c441b48184d3b4323144511379041e94a567945e85f31d2c5676e

Download Submit
C:\Windows\System32\mfc120cht.dll

Filesize
45KB

MD5
35bde055469e774c815c7eff219a08ee

SHA1
31e02484e626c8475286e8e5ddfcea2ecd28a279

SHA256
e97ad479a4139adac6399655551348bfc289d84b1b3f22b2415f1d26bc899bdf

SHA512
4810930577159a78d66708e3077df1794f0c7adcad19a9114439ecacd2e8499973bfb632590d8202ea0c087110a70b1a23aebe9ab34387c4dd259c3543ce36d4

Download Submit
C:\Windows\System32\mfc120deu.dll

Filesize
73KB

MD5
6b2530874f3e108a4f98db91446f0724

SHA1
8e0d8707aea0ed3da2ea5cb72caf6d3a6399259c

SHA256
b2772db0688b3c86134a1969bae17fd6aae1c8240a1f5910c0a724522abcc581

SHA512
d29fb6375a1e85cec3d09c28a8fd121a1a155ae1b51c7d3d6cb2b6c9f5f4af73ea90cbff9e8f80a16f90ab66ca907838d4d662300112f8d6110146c4a36efbb2

Download Submit
C:\Windows\System32\mfc120enu.dll

Filesize
63KB

MD5
740abd194f5e72e3980cf622e6cb41af

SHA1
fb52b9b8ed399ac267c7117a457945305082ff73

SHA256
40a552625932701b7d300e36d46b79a352256406f8fe1046d66b8da06636e421

SHA512
0d8226c53e5f3fcf0009ec6cd9b518e276040ce0b367289c118d8fd623440a0583387b2753776beb83d6588e982da4093627faa0a22443dd36868766799dd8b0

Download Submit
C:\Windows\System32\mfc120esn.dll

Filesize
72KB

MD5
d78ce649777f9e35d2f014a7074bab72

SHA1
1739e8362581cd9eb2ba36746823a19718ee8bb8

SHA256
418c8454e90e20357a91d0d3256c2e944c8578f65b5de169823037caae1dafc6

SHA512
aab61f05d05bb9e8cc1523dcb39d8f429a0686194658c41484425b588877bd96a920c07a52113382363f0cdc8bd25cda60932ef8f074faeede58edf9b76bb8ca

Download Submit
C:\Windows\System32\mfc120fra.dll

Filesize
73KB

MD5
13fa0653a0cf0e5d6e83859e447f2303

SHA1
8fbfaa952fe68ae9d6a64a487ed41190796e9c29

SHA256
55583148630eb2ab63f387aacebe00562cbfd4068ffe3dbde234c5f410f7fe24

SHA512
bd7158fd33d27a6afc44e6fdfaedf4c76d8004fced11a10688d7e02dd58bad1a2197121861e387f33e0670296a0565eaddb5a9fd496fa6ed741dc2f9aadf07d7

Download Submit
C:\Windows\System32\mfc120ita.dll

Filesize
71KB

MD5
3516ae713fe141df351540d639b8c98d

SHA1
fbe0b4685aba672a08146b11dd080d87c803d78f

SHA256
8161b0c144a5b243c42a0f7a42075b319495e9e7b0853de50b239187af1ebfc1

SHA512
559be2e05f8385c68d693950f417ef8cae396736b5ba3435dfbeded5f20942e27e652fc1b9647c0455acfb69193dfe9a68adf8d211ae830580fb772f4fa54db0

Download Submit
C:\Windows\System32\mfc120jpn.dll

Filesize
52KB

MD5
49e6ba38de51d6fd0f333ef9a6150217

SHA1
4e780114c1e3c7dc4ab197f1518b50327afb1616

SHA256
97b63b34b59196bac34a2ad26eeae5812affbc643174f64aa142be3ca6bbcad1

SHA512
1f7ca2da137fb7b282c2d55599552b77a9e42e25b6e4fd2071d341d7ea74eb4a6eb7a6826cb5e945689781767fe7e99f818d4696e211809dec0ebff66f0f6eac

Download Submit
C:\Windows\System32\mfc120kor.dll

Filesize
52KB

MD5
79114c9df498f70195ddc93aecaaf726

SHA1
48b362edfd4093793a9631463a15825098a18dba

SHA256
4327e89baf445830750e05f3510e4b84e83f6700e63db028544107534bcea783

SHA512
ef2b1d58ee75578f4be123424bc2f73371b85d631985c73308319f6740f73f4790ddd45376c6ef420636576ed279184b8661a2dac3c8fa3a0fee1fd39d39834f

Download Submit
C:\Windows\System32\mfc120rus.dll

Filesize
69KB

MD5
36fdc1f74d583543e82b17bcc59acede

SHA1
1387093951c180340fac724832a0b83834e5700a

SHA256
ee413bf57e7fd579003b4fabe5a08e94a9e194a6ad1fbd0fd34dbf7d009bb68a

SHA512
5745e4a3c887aebb5a6fb3fcb198ba313bce2f231053fa54f906d0bfab9db05f5a5ac9835cee435c6713ef147b5c564dd318e08a51e7f2c79f996ddf03e80359

Download Submit
C:\Windows\System32\mfc120u.dll

Filesize
5.4MB

MD5
f7d3fc7c0ed92e2de47f7f85b684a51a

SHA1
1707da9aa8460cb65ac7946805cec12cca6db8b3

SHA256
d822ec4e09fdf5446e62c09cf5819146f09a4670f77aaa81e4133b912592f1f9

SHA512
fbcabf3b8cce40a9829fb9894cdb751662cc3a3b41f962691075d7e5d18831ad8c43c697e7919b4b1e96288015be3544637ded1ac0427844f810be6c2f221a1d

Download Submit
C:\Windows\System32\mfc140.dll

Filesize
5.4MB

MD5
995d4a4099509e987d544777fc138d35

SHA1
a22ed004342b6473d44d9c94826935e61f2ad8f1

SHA256
c024b330b25ba4a26de9436c669a8a2bf6cf37622088c165b9ad059bd3bc2a5c

SHA512
e7f25871754c8095edca334fda992d2051772f51e74f94d6762842374a05274ebdaa9975d3fd1f5304f886ddfcdd615292a55799224f4e7504c323650ee8519f

Download Submit
C:\Windows\System32\mfc140chs.dll

Filesize
50KB

MD5
93c098d594b3411deaebf2c704266495

SHA1
9effd633917c6cb93ffb17efdf54f45d0568f222

SHA256
77c4d9b27e9af248ddb96303ac09384dc0af403f4671e0ea4d56014f9f7dfbdf

SHA512
e28209fc5b3914c29fa16613edc82801ad26ecd0907f6db6c6ab0da0bde9b670231cccc12e29664c9c702d508c3b1032d76253817405987bc338623fccc1d44d

Download Submit
C:\Windows\System32\mfc140cht.dll

Filesize
49KB

MD5
54c4ff24bc0ec0f3e4d1a1970962bc64

SHA1
84e32c55a11aaaedf832f1862fb1c15e2ac1027b

SHA256
7c699f4734af65180008f09b65e1cb42e16cef4afa422f689fb7a28a3e702bd2

SHA512
c7eb3b2d0ece5d0e70f77aee55d8bf7a51c1736e27510c883b482f569f5853a7b3494751079c87314ea462f643361316d13d71d3e7f2da84aca351c202572bef

Download Submit
C:\Windows\System32\mfc140deu.dll

Filesize
78KB

MD5
1e01595040057a7498be38af59cd190d

SHA1
297591cfd3a5f47eef6393a57987f91cee8c739b

SHA256
9f9f7b55cf6a0dd2df089c3cd3bf14a48a1fc40e488169c875974122c5f4de30

SHA512
a79b2226ffc50e305b73c0d37966635388115bd93bca256f0ebbba547af932799816e25804c7dd3e7dedc6688e10e610d473a6d85051a7a156d24a11a90eaa06

Download Submit
C:\Windows\System32\mfc140enu.dll

Filesize
68KB

MD5
dbe196f1ef1255f82edf67c393c4b22d

SHA1
f7ebb901519254887ef9b34325d8e2ba21260c63

SHA256
584bc6d662c75304b69b8bf03cba9cc423b82d8cc8b120e9823575168ce16e26

SHA512
49ed47dabc3c8e0bba7f696dcaae5b93ab2265a2450d45a9b31d16ec3f5d5e95c2885a175ed8606d86b16050e0769e421d98c40cfaa621e671ce9806e353f438

Download Submit
C:\Windows\System32\mfc140esn.dll

Filesize
77KB

MD5
79ab9f8d5bc7505aa30a82b8d8ea98e7

SHA1
2a6025228d1e2746b04739269f0bab795ec0a170

SHA256
01a6f691acd0e51bfab6e968d03cd16f8dd038370439d991b7422fd0761c75e1

SHA512
aee4ea4bdfbab343a1ddac4edd5e701bb76119dc2ea1030c316f7aa45abf06b114b10adbe4185603bc725e2ad2c993675050b1946ad123a45ad0f834e733117d

Download Submit
C:\Windows\System32\mfc140fra.dll

Filesize
78KB

MD5
1acab9e683a06442a8a1307f84333bc9

SHA1
88f46aba9153e773d91e26a945c12756ecf69b52

SHA256
82e354fd61d5c2b48b37a94518858cbafc5a17d987eb03148a562c90a4b8be7f

SHA512
c244ddf540b20bd32d5d79433ef222d0adeac293211c57e8bbbe6016f7c70fae502c4467d4c3663af1a6fd70a4b992d3e72f64b432408ae0c098f254daadf9f7

Download Submit
C:\Windows\System32\mfc140ita.dll

Filesize
76KB

MD5
9463fb2858be759416ca0027ae41d269

SHA1
6a01e8712f57c505c710da67f7947271ecd28beb

SHA256
5aa4b4f61d28ababef5123c21f54d2fb3cabfcb1a3a7e58f763f69ea47561b18

SHA512
b6b2b281b773f593851b8b63dda2cac73bec14dfbf296aa3d3fe4b82586d92831aecdea30763e07b05ab3a3ae8245909b4310b69e583d1ae0c9a9a1fa55de845

Download Submit
C:\Windows\System32\mfc140jpn.dll

Filesize
57KB

MD5
6690704ae9b7f70847af8c8ff2cb78d4

SHA1
5c9c557698e50d8f9a374a5931b16632e27c42e2

SHA256
5e918b3ba996ab17e82fb8dadbe8234f59866215ad20deb0fbf8c0f8f041c575

SHA512
d0bd7b16e8215a617c32fcc5542cf1ec436764cb9b817b232699ec2efd5fc3bf1e9d87939a461c73c7e6515907c0113bf4e111bed6fe6586670f394463508474

Download Submit
C:\Windows\System32\mfc140kor.dll

Filesize
57KB

MD5
992f24b869da11b28e9d7ed7ace7e4f3

SHA1
75ec5f14831b5025f2b4bb21c73452464b67cf07

SHA256
2b394ba22768549f01018fb3700a26974b609f3ab9298024d6e05b8da2ced31a

SHA512
8ffce604963493ea78c7c8e5465c8ab3e0a2dc79a5a8ffa7b6b0965e7169c2afe5d774805f797d2f5aa39d207dccd95b17020fe0f85699a2e8a66f968a7bb6bd

Download Submit
C:\Windows\System32\mfc140rus.dll

Filesize
74KB

MD5
d2f695f53af32c345f04c04c2734bd57

SHA1
b5e45cc7c97d1e866efe3263dbc9b0f842dcef31

SHA256
aed5103f75243342af6037588d8b14aaea94d74d6719cc6d813c6f59f2e59b63

SHA512
a58f519d9934dd49b855591ac4c033d1919fd317d9a154a44729a04a436d5a01ddcce7cc9add22fbe49c75f11d6b0317c80f6a7020b1d5aa83b36233666ec872

Download Submit
C:\Windows\System32\mfc140u.dll

Filesize
5.4MB

MD5
9af4bf53dd24f2fbfe872bf377c4189a

SHA1
4860faadf764f7928ef96ef870c5d4cd30a0a0da

SHA256
fe48df9d38184a355f0590a3ffe1156e4cc45b727a7da8b922f6761cae7c790d

SHA512
4d5dee641c2f97fa4f280b7106341a8ff259729be6c71020d6a592028f32b22df89eeae82f3571db4326d13b0a306bdfb1cdc53afc51fadd01de219e8e922277

Download Submit
C:\Windows\System32\mfcm120.dll

Filesize
89KB

MD5
480f828bd5b34c59c288f55cb363cad2

SHA1
95499b7f1005666fb5d273c1b96e8fd239d95866

SHA256
431e7373dee1eee2ab86588dea061394edf14a364c026dd47582d982befb1d78

SHA512
c55021ac4b34f32b0c5bdda842fc52756759723b57da0f82407291eb928b90c71aa6f61c74b209de14132530c4bd0de838c64d34e6f746c76e10342001c67122

Download Submit
C:\Windows\System32\mfcm120u.dll

Filesize
89KB

MD5
d739c219492aea851d4b71127b310e83

SHA1
488401ec9413c025c5a7ce9aedc0b7629579a4a6

SHA256
f0cfcc1a9cd9b246b53fe14fa2f77975763a6de5fbb3a98cf5ea622be0c62cea

SHA512
a1dd96d1e3bd21382879c0b68b81b2740c14f5dae9490800a9bd8534a7cf13030163d4149f56e602b903e4df23a7f0b0b5b3f0f294e1c30b7bebc4f89d971d7c

Download Submit
C:\Windows\System32\mfcm140.dll

Filesize
94KB

MD5
4145cdee65b65558d850b23d15a0d427

SHA1
13348bdf7904ca17d618d51035bcf2d7e4e49d99

SHA256
ab136a28ffc9e1f8365c6c019e258b3424bde76a2b7bff785d7122223af05e4e

SHA512
20d6473b4feddfa5d21b49f04567ddf1e9f524d2a6287c30bcf152771f13f7531cb45d4059beaac5ffc30678b77a2beeb1530c93aceeee22bee36891fde4d8bf

Download Submit
C:\Windows\System32\mfcm140u.dll

Filesize
94KB

MD5
adb8ca405eba61da098e9441e767c8f6

SHA1
74b6ec61afb3435707f14bb59bc37b67f100d75e

SHA256
0ca949b7ee707e16e3c2e8999df2ef209f44afb8a49a259ebf96419515f6c3a6

SHA512
8ee4b747e7012960d6e9574d939c96b4ca7b682448cf624182d7482312aba237917ec57e3b456fe7618380c3a06e2e02adbaa435c4bb670894bec6de2002bbac

Download Submit
C:\Windows\System32\msvcp120.dll

Filesize
644KB

MD5
c2028ba6c66363b36ea659ca8816265d

SHA1
5e2bda10ad417466290dc08fd6ee8bc5fcf0ebbd

SHA256
3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c

SHA512
28e87d7360c4bd2eb30152173da6fdf30340b5ff0186a68f26514088dcc15758851afd01a179e976a91a9a85f9c1ee0cfa40308ed9d42654739acf6f6dd773f4

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
561KB

MD5
72f3d84384e888bf0d38852eb863026b

SHA1
8e6a0257591eb913ae7d0e975c56306b3f680b3f

SHA256
a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde

SHA512
6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6

Download Submit
C:\Windows\System32\msvcp140_1.dll

Filesize
34KB

MD5
34a0ee0318a6be3f4a17826e5c17f8e3

SHA1
5b252d10138d6666892ca9da1e1d95af24de1097

SHA256
91cd05c16c61c39788c47434602a59c17f5b08dbb3eee04ce85f8d5b70e8e604

SHA512
ffd28202e3dd91b89b7d3161f33243e52e8a0b59d31d917c3cd0005c1e97cc818d1ebba9a4971e602164d31b42448c8fef8d0204618ef4134255876c7bd7fe5b

Download Submit
C:\Windows\System32\msvcp140_2.dll

Filesize
262KB

MD5
0c462afe7502e3646086ea7783022c11

SHA1
b5a6f2d00b7903cf8f4d2ff26980e2ae612ade1e

SHA256
713f17b253d802d283d306ce75647e37d83a546aeb1a881e5d9e529e856c007e

SHA512
6b30815c46bd54778e649aea48f8de64b4b7c49123060737a0cbdb13888669672aeef244a1e16c7c8c8e0d1d2a480309f30d51d2ab11c4debb3ea67f9337e0d6

Download Submit
C:\Windows\System32\msvcp140_atomic_wait.dll

Filesize
49KB

MD5
087850398c58be95af0e02b1a31389c7

SHA1
a42f044fa0d210d7e96078e2d6ffe0753afd387a

SHA256
aede4ec454a82f146eb4a721e616e2086870107d88aabc6b0bd1eea0a505d935

SHA512
eb4b035ad1a7750b213a8d7ad4d026a09bf2e2a934c60434c43176565e24ccdeec5fcf2c8a9b693021be435a64d4682b951622b4037f444f4ed32db8b3669267

Download Submit
C:\Windows\System32\msvcp140_codecvt_ids.dll

Filesize
31KB

MD5
504886fe5e0e0f37c17382d7d3fd9ead

SHA1
63adee20e54004187275ff6020e81eed3a3b17f7

SHA256
d52d349fbbe6abc61965c07e04cc82d8ee0cea1de7faf90a838964e3f40acedd

SHA512
edeb344b5a3413073a8ac93a5f10f665ac72ad1eb8749911abd9909e62a2ed97db7a8ede56b4427a1cf18683a277a3a4d09a4facd7e046af23ccef93b588de46

Download Submit
C:\Windows\System32\msvcr120.dll

Filesize
940KB

MD5
b70474fe249402e251a94753b742788c

SHA1
f53b3c21adf75dc84977067869253e207f1b9795

SHA256
753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6

SHA512
7776e05fe58cb3c12a4a020def9596ecfb6dc1b1f8ca010ec27a8ae027eadf1eef901acbafe042e2f7b31d1920f62ce163342acf37f96802ec27d68ac7bf972e

Download Submit
C:\Windows\System32\vcamp120.dll

Filesize
470KB

MD5
7fa53d11d558d61228a8e0c4d9f71b00

SHA1
be78d57d1d5899a3aa77c95f6f9eaa638c3f7db0

SHA256
096a72b8aced30f604b0dff52be3dd1c7354c0d6a528e3060e9f62696fcd843e

SHA512
c6616a768b8c18998dfa722d8f0d7fbc6e51cd1bb74b3360343a6a06762a9d6d38debf241950fa3acacf9c5681f7e510b62d346e052c2f3b211daacf2edf9de6

Download Submit
C:\Windows\System32\vcamp140.dll

Filesize
398KB

MD5
2d59d57503b39c2df275ceebbd604fb3

SHA1
2e342e3e08540b98bb44433a02c7eaa9f75cddfb

SHA256
fb7bdd33bb74948c14c388ffcdfcda2cde63a357f1e9dcd01d5912b1008627c8

SHA512
24f5bb0101b64b31afd9e7cdd7f7aafe4b005e9c5840cdad52a908d2a9bbeb836b3cc7a410360df7302a0e522f2a83765fc4df92148a1f58573980e2a58833c4

Download Submit
C:\Windows\System32\vccorlib120.dll

Filesize
348KB

MD5
6d62e7d709caab4a459ede82366853c0

SHA1
d6de1fac72ba254538f2c754928cc35b3ab103ac

SHA256
5a357a9f10d55b70e50a04b0b6716263e678e877e0934f536cc82aa1c3072c25

SHA512
0d478fc2c9c5e7cb6a331a0e11156d85a8eca2b99b1108dc145680f511051d83547fa56073b377212597b5b94b9a77e661178d2549a59ab251700733ed156cf3

Download Submit
C:\Windows\System32\vccorlib140.dll

Filesize
343KB

MD5
8cdf8ac0b26620636015f9f2386071f7

SHA1
cc3719ff6bed1107091f47d6985eb4304c2d730b

SHA256
086fab8accce357da499e6024e4290aa89dfc219867c90d90c62f8247591b95b

SHA512
afa5df97f2fa4ab6cb371c75bd10209b4216b4cc2b0a3b428e61768e320b1f058fd159c3b4aca0184d6640efc869000992dce17d63a061b567f5c13523e49692

Download Submit
C:\Windows\System32\vcomp120.dll

Filesize
134KB

MD5
72a89f606f0efc608b36288bc32705a2

SHA1
dc6371903ece074d792b2af264fbf2cc49b1cae2

SHA256
7fd73132d9579eebb2e6ee202babc6a49b3744de84c9b34fede0b3be95ec98bb

SHA512
8b23c3b4830f261608776c44b2a5d31db598b1bfb14bcefd0da1ab52159af35e6da54cb09dda4a587e7157b10504b54d373a2497292ad5b2e40ffbc552668b57

Download Submit
C:\Windows\System32\vcomp140.dll

Filesize
187KB

MD5
d1c40897546d939908544241ced181a7

SHA1
2df4f5969c1beeeef5188145d3a3f9885b214069

SHA256
48b2cffa42a5064ba299eff1733753f4fa042d9d452c49c11d4fad27360f78ae

SHA512
b935cf900b326b55429b1f61583001f1af13401756950b9237c029a8c9b766525c2015b600a7a9248ca54651d17372e49d721f40a4d21b61a5777237a94655c3

Download Submit
C:\Windows\System32\vcruntime140.dll

Filesize
117KB

MD5
caf9edded91c1f6c0022b278c16679aa

SHA1
4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a

SHA256
02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a

SHA512
32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362

Download Submit
C:\Windows\System32\vcruntime140_1.dll

Filesize
48KB

MD5
2bd576cbc5cb712935eb1b10e4d312f5

SHA1
dfa7a46012483837f47d8c870973a2dea786d9ff

SHA256
7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637

SHA512
abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542

Download Submit
C:\Windows\System32\vcruntime140_threads.dll

Filesize
37KB

MD5
bdf2cce416721ed11309d6974bd03d7e

SHA1
87c61049a532dd363688552fb0901a164cba550c

SHA256
75f3540ebe0876c1b173821d2669987c088c3f6db985305d160460f476536a89

SHA512
d3df3c131e5cad221bef9e0179d59814930f06b4f4608e74b270cec94a8463c2886352a5219fc2133694763cc3277e5e0bf56308ef7164f37144974814d50305

Download Submit
C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
d5a3fd8ad806f66d33d652d5913a95b3

SHA1
7b1bb6cdbe700acc2434dc52c40cdd96a6462a17

SHA256
cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a

SHA512
594d710133f44049546c62c3c89614415ad776c24f3ada0a8d1724e6daf27f941eba43a05a096d90cdf51ad51c02462edd6308e2aa393cb8325fde256ed77037

Download Submit
C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\cab5046A8AB272BF37297BB7928664C9503

Filesize
962KB

MD5
8eccd85b6c4273a28a54b0687feb6a96

SHA1
be791128af5713d407df2f7436ea8de1a80ca725

SHA256
8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd

SHA512
9fdcb359a5748d0d920e1e12cf31de42fa224840fd11e5878f7caff7c4495b4facacf1a58cdaf0caadd0d9a3af871870b755245d2c1af33f07f3229b85101da0

Download Submit
C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
5fc68510b7425822a9d0928567ffbd1b

SHA1
f506d97ceac3c435ce6bafda7c47d9a35fc57714

SHA256
7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28

SHA512
4dd4d99ace30eb1add9ae225f159f68636d42d1899acb50f616717f05045e402a2bbb76e4d86569a08ae74bb161b3911a73910fcc7044429da34159cf6b9f473

Download Submit
C:\Windows\Temp\{4EE4103E-CFE8-4A31-A5A5-487257FC3CC8}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{A9720D04-CD2A-4DDB-96B1-CD1A08A4300B}\.cr\VC_redist.x64 - (1).exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
C:\Windows\Temp\{B718385A-F7ED-497B-BE9C-453D76D4F794}\.ba\license.rtf

Filesize
9KB

MD5
04b33f0a9081c10e85d0e495a1294f83

SHA1
1efe2fb2d014a731b752672745f9ffecdd716412

SHA256
8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

SHA512
d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

Download Submit
C:\Windows\Temp\{B718385A-F7ED-497B-BE9C-453D76D4F794}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
memory/340-3320-0x000002BE52D30000-0x000002BE52D5B000-memory.dmp

Filesize
172KB

Download
memory/340-3321-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/408-3327-0x000001F97ACF0000-0x000001F97AD1B000-memory.dmp

Filesize
172KB

Download
memory/408-3328-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/616-3310-0x000002092A3D0000-0x000002092A3F4000-memory.dmp

Filesize
144KB

Download
memory/616-3318-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/616-3317-0x000002092A400000-0x000002092A42B000-memory.dmp

Filesize
172KB

Download
memory/672-3312-0x000002636CDC0000-0x000002636CDEB000-memory.dmp

Filesize
172KB

Download
memory/672-3313-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/844-3628-0x0000024C41E70000-0x0000024C41E7A000-memory.dmp

Filesize
40KB

Download
memory/844-3633-0x0000024C44440000-0x0000024C44446000-memory.dmp

Filesize
24KB

Download
memory/844-3619-0x0000024C41E50000-0x0000024C41E6C000-memory.dmp

Filesize
112KB

Download
memory/844-3626-0x0000024C44240000-0x0000024C442F5000-memory.dmp

Filesize
724KB

Download
memory/844-3632-0x0000024C41E90000-0x0000024C41E98000-memory.dmp

Filesize
32KB

Download
memory/844-3634-0x0000024C44450000-0x0000024C4445A000-memory.dmp

Filesize
40KB

Download
memory/844-3629-0x0000024C41EA0000-0x0000024C41EBC000-memory.dmp

Filesize
112KB

Download
memory/844-3630-0x0000024C41E80000-0x0000024C41E8A000-memory.dmp

Filesize
40KB

Download
memory/844-3631-0x0000024C44460000-0x0000024C4447A000-memory.dmp

Filesize
104KB

Download
memory/960-3324-0x000001F6D4DA0000-0x000001F6D4DCB000-memory.dmp

Filesize
172KB

Download
memory/960-3325-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1028-3344-0x00000209FDE00000-0x00000209FDE2B000-memory.dmp

Filesize
172KB

Download
memory/1028-3345-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1112-3348-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1112-3347-0x00000202A5C90000-0x00000202A5CBB000-memory.dmp

Filesize
172KB

Download
memory/1136-3351-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1136-3350-0x0000013EF7F40000-0x0000013EF7F6B000-memory.dmp

Filesize
172KB

Download
memory/1176-3354-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1176-3353-0x000001E3972E0000-0x000001E39730B000-memory.dmp

Filesize
172KB

Download
memory/1188-3356-0x0000024085630000-0x000002408565B000-memory.dmp

Filesize
172KB

Download
memory/1188-3357-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1300-3361-0x000002691DD30000-0x000002691DD5B000-memory.dmp

Filesize
172KB

Download
memory/1300-3362-0x00007FF82B030000-0x00007FF82B040000-memory.dmp

Filesize
64KB

Download
memory/1328-3364-0x000001F2E2C60000-0x000001F2E2C8B000-memory.dmp

Filesize
172KB

Download
memory/1484-682-0x00000000002A0000-0x0000000000317000-memory.dmp

Filesize
476KB

Download
memory/1656-3305-0x00007FF86AD70000-0x00007FF86AE2E000-memory.dmp

Filesize
760KB

Download
memory/1656-3304-0x00007FF86AFB0000-0x00007FF86B1A5000-memory.dmp

Filesize
2.0MB

Download
memory/1656-3303-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1656-3299-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1656-3300-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1656-3301-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1656-3298-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1656-3307-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1956-3286-0x0000017F32300000-0x0000017F32322000-memory.dmp

Filesize
136KB

Download
memory/2112-3257-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2112-3256-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2336-3179-0x0000000007C50000-0x0000000007CF3000-memory.dmp

Filesize
652KB

Download
memory/2336-3155-0x0000000008290000-0x000000000890A000-memory.dmp

Filesize
6.5MB

Download
memory/2336-3168-0x000000006FFD0000-0x0000000070324000-memory.dmp

Filesize
3.3MB

Download
memory/2336-3180-0x0000000007D40000-0x0000000007D4A000-memory.dmp

Filesize
40KB

Download
memory/2336-3178-0x00000000079E0000-0x00000000079FE000-memory.dmp

Filesize
120KB

Download
memory/2336-3133-0x0000000002FF0000-0x0000000003026000-memory.dmp

Filesize
216KB

Download
memory/2336-3166-0x0000000007C10000-0x0000000007C42000-memory.dmp

Filesize
200KB

Download
memory/2336-3186-0x0000000007F30000-0x0000000007F38000-memory.dmp

Filesize
32KB

Download
memory/2336-3185-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

Filesize
104KB

Download
memory/2336-3184-0x0000000007EF0000-0x0000000007F04000-memory.dmp

Filesize
80KB

Download
memory/2336-3183-0x0000000007EE0000-0x0000000007EEE000-memory.dmp

Filesize
56KB

Download
memory/2336-3182-0x0000000007EB0000-0x0000000007EC1000-memory.dmp

Filesize
68KB

Download
memory/2336-3181-0x0000000007F40000-0x0000000007FD6000-memory.dmp

Filesize
600KB

Download
memory/2336-3164-0x0000000006EB0000-0x0000000006EB8000-memory.dmp

Filesize
32KB

Download
memory/2336-3156-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Filesize
104KB

Download
memory/2336-3167-0x000000006FE70000-0x000000006FEBC000-memory.dmp

Filesize
304KB

Download
memory/2336-3154-0x0000000006950000-0x000000000699C000-memory.dmp

Filesize
304KB

Download
memory/2336-3153-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/2336-3152-0x0000000006450000-0x00000000067A4000-memory.dmp

Filesize
3.3MB

Download
memory/2336-3142-0x00000000062C0000-0x0000000006326000-memory.dmp

Filesize
408KB

Download
memory/2336-3136-0x0000000006250000-0x00000000062B6000-memory.dmp

Filesize
408KB

Download
memory/2336-3135-0x0000000005A70000-0x0000000005A92000-memory.dmp

Filesize
136KB

Download
memory/2336-3134-0x0000000005BB0000-0x00000000061D8000-memory.dmp

Filesize
6.2MB

Download
memory/2444-3219-0x0000000000DD0000-0x0000000001058000-memory.dmp

Filesize
2.5MB

Download
memory/2444-3241-0x0000000005E60000-0x0000000006404000-memory.dmp

Filesize
5.6MB

Download
memory/2524-379-0x0000000000D80000-0x0000000000DE5000-memory.dmp

Filesize
404KB

Download
memory/2848-381-0x0000000000D80000-0x0000000000DE5000-memory.dmp

Filesize
404KB

Download
memory/3780-645-0x00000000002A0000-0x0000000000317000-memory.dmp

Filesize
476KB

Download
memory/3936-683-0x00000000002A0000-0x0000000000317000-memory.dmp

Filesize
476KB

Download