Analysis
-
max time kernel
1045s -
max time network
1053s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
08/04/2025, 06:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trovi.com
Resource
win10ltsc2021-20250314-en
General
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-809364120-1453366396-340093129-1000\KCDSQSMIX-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/a214b670dcf83a85
Signatures
-
CryptoLocker
Ransomware family with multiple variants.
-
Cryptolocker family
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Floxif family
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Infinitylock family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000800000002458d-9975.dat floxif -
Renames multiple (639) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (862) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Downloads MZ/PE file 4 IoCs
flow pid Process 583 2368 msedge.exe 1707 2368 msedge.exe 1707 2368 msedge.exe 801 2368 msedge.exe -
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe -
Sets service image path in registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iteayrprtfnzonnvj\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\iteayrprtfnzonnvj.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oxwckmqfeqzwoj\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\oxwckmqfeqzwoj.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bsehevcrdhjfjlo\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\bsehevcrdhjfjlo.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssqlaq.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssql.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zkjyhpxjhoabwckn\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\zkjyhpxjhoabwckn.sys" mssql.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wywvdicxuodpusgx\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\wywvdicxuodpusgx.sys" mssql.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000800000002458d-9975.dat acprotect -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DriverUpdater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DriverUpdater.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\International\Geo\Nation DriverUpdater.exe Key value queried \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\International\Geo\Nation MinecraftInstaller.exe Key value queried \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\International\Geo\Nation ramexpert_lite.tmp Key value queried \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\International\Geo\Nation Windows-outbyte-driver-updater.exe Key value queried \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\International\Geo\Nation Installer.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 11 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe DeriaLock.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\KCDSQSMIX-MANUAL.txt GandCrab.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\dcf83d69dcf83a8750.lock GandCrab.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe -
Executes dropped EXE 26 IoCs
pid Process 236 PixelSee_id1663317id.exe 7016 Windows-outbyte-driver-updater.exe 6256 Windows-outbyte-driver-updater.exe 5640 Installer.exe 7156 Windows-outbyte-driver-updater.exe 4984 ServiceHelper.Agent.exe 4908 DriverUpdater.exe 7816 ServiceHelper.Agent.exe 7904 DriverUpdater.exe 236 MinecraftInstaller.exe 6600 GamingRepair.exe 7456 ramexpert_lite.exe 8312 ramexpert_lite.tmp 6696 RAMExpert.exe 4532 spoclsv.exe 3920 spoclsv.exe 6016 spoclsv.exe 5128 msedge.exe 7312 {34184A33-0407-212E-3320-09040709E2C2}.exe 7224 {34184A33-0407-212E-3320-09040709E2C2}.exe 7172 {34184A33-0407-212E-3320-09040709E2C2}.exe 6040 CoronaVirus.exe 6184 nc123.exe 10704 mssql.exe 14668 mssql2.exe 29468 SearchHost.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\zkjyhpxjhoabwckn.sys mssql.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\WYWVDICXUODPUSGX.SYS mssql.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\OXWCKMQFEQZWOJ.SYS mssql.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bsehevcrdhjfjlo.sys mssql.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\BSEHEVCRDHJFJLO.SYS mssql.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\ZKJYHPXJHOABWCKN.SYS mssql.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wywvdicxuodpusgx.sys mssql.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iteayrprtfnzonnvj.sys mssql.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\ITEAYRPRTFNZONNVJ.SYS mssql.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\oxwckmqfeqzwoj.sys mssql.exe -
Loads dropped DLL 64 IoCs
pid Process 7016 Windows-outbyte-driver-updater.exe 7016 Windows-outbyte-driver-updater.exe 7016 Windows-outbyte-driver-updater.exe 7016 Windows-outbyte-driver-updater.exe 6256 Windows-outbyte-driver-updater.exe 6256 Windows-outbyte-driver-updater.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 5640 Installer.exe 7156 Windows-outbyte-driver-updater.exe 7156 Windows-outbyte-driver-updater.exe 5640 Installer.exe 5640 Installer.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 5640 Installer.exe 5640 Installer.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe" {34184A33-0407-212E-3320-09040709E2C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" CoronaVirus.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Music\desktop.ini CoronaVirus.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-809364120-1453366396-340093129-1000\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files (x86)\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Videos\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Videos\desktop.ini CoronaVirus.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-809364120-1453366396-340093129-1000\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Music\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Searches\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini CoronaVirus.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: xpajB.exe File opened (read-only) \??\n: xpaj.exe File opened (read-only) \??\o: xpaj.exe File opened (read-only) \??\t: xpaj.exe File opened (read-only) \??\x: xpaj.exe File opened (read-only) \??\J: GandCrab.exe File opened (read-only) \??\Y: GandCrab.exe File opened (read-only) \??\s: xpajB.exe File opened (read-only) \??\h: xpaj.exe File opened (read-only) \??\w: xpaj.exe File opened (read-only) \??\q: xpajB.exe File opened (read-only) \??\u: xpaj.exe File opened (read-only) \??\v: xpaj.exe File opened (read-only) \??\d: xpajB.exe File opened (read-only) \??\B: GandCrab.exe File opened (read-only) \??\G: GandCrab.exe File opened (read-only) \??\Q: GandCrab.exe File opened (read-only) \??\S: GandCrab.exe File opened (read-only) \??\i: xpaj.exe File opened (read-only) \??\j: xpaj.exe File opened (read-only) \??\O: GandCrab.exe File opened (read-only) \??\R: GandCrab.exe File opened (read-only) \??\g: xpajB.exe File opened (read-only) \??\q: xpaj.exe File opened (read-only) \??\F: DriverUpdater.exe File opened (read-only) \??\g: xpaj.exe File opened (read-only) \??\n: xpajB.exe File opened (read-only) \??\v: xpajB.exe File opened (read-only) \??\x: xpajB.exe File opened (read-only) \??\k: xpaj.exe File opened (read-only) \??\m: xpaj.exe File opened (read-only) \??\P: GandCrab.exe File opened (read-only) \??\A: GandCrab.exe File opened (read-only) \??\H: GandCrab.exe File opened (read-only) \??\X: GandCrab.exe File opened (read-only) \??\p: xpajB.exe File opened (read-only) \??\r: xpajB.exe File opened (read-only) \??\t: xpajB.exe File opened (read-only) \??\y: xpaj.exe File opened (read-only) \??\N: GandCrab.exe File opened (read-only) \??\h: xpajB.exe File opened (read-only) \??\y: xpajB.exe File opened (read-only) \??\p: xpaj.exe File opened (read-only) \??\r: xpaj.exe File opened (read-only) \??\l: xpaj.exe File opened (read-only) \??\K: GandCrab.exe File opened (read-only) \??\U: GandCrab.exe File opened (read-only) \??\Z: GandCrab.exe File opened (read-only) \??\s: xpaj.exe File opened (read-only) \??\D: GandCrab.exe File opened (read-only) \??\l: xpajB.exe File opened (read-only) \??\w: xpajB.exe File opened (read-only) \??\d: xpaj.exe File opened (read-only) \??\V: GandCrab.exe File opened (read-only) \??\o: xpajB.exe File opened (read-only) \??\u: xpajB.exe File opened (read-only) \??\T: GandCrab.exe File opened (read-only) \??\i: xpajB.exe File opened (read-only) \??\k: xpajB.exe File opened (read-only) \??\I: GandCrab.exe File opened (read-only) \??\M: GandCrab.exe File opened (read-only) \??\m: xpajB.exe File opened (read-only) \??\L: GandCrab.exe File opened (read-only) \??\W: GandCrab.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 643 api.ipgeolocation.io 656 api.ipgeolocation.io 642 api.ipgeolocation.io -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc pid Process 1148 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html 2368 msedge.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DriverUpdater.exe File opened for modification \??\PHYSICALDRIVE0 xpaj.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\DriverStore\FileRepository\mdmelsa.inf_amd64_f187fca538857daa\mdmelsa.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmtron.inf_amd64_0b075e1cb11005f4\mdmtron.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\ndisimplatform.inf_amd64_b6b644565437983a\ndisimplatform.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\cht4sx64.inf_amd64_3a69b9b79f49eb50\cht4sx64.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\intelpep.inf_amd64_7cf9a726e4552081\intelpep.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_283a44fe508f0682\tsusbhubfilter.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_230f9025c8623e5d\usbport.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\c_fsinfrastructure.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmusrg.inf_amd64_bb7c44c7bb3664d0\mdmusrg.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_c5ee07feb8dae038\mdmzyxlg.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_ucm.inf_amd64_c30468a947db0fa8\c_ucm.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\microsoft_bluetooth_hfp_hf.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\oposdrv.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\smrdisk.inf_amd64_f945aad6094163f4\smrdisk.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\uefi.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_diskdrive.inf_amd64_b9514774871140a4\c_diskdrive.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_sdhost.inf_amd64_b71f983cb35bfde3\c_sdhost.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\ipmidrv.inf_amd64_6ca4f16705af5e77\ipmidrv.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_0d8225e7d2696ece\mbtr8897w81x64.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\ndisuio.inf_amd64_6096fd74a67ccd5d\ndisuio.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\termmou.inf_amd64_c4c8f901e3534194\termmou.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\c_magneticstripereader.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmrock3.inf_amd64_9977beff54a96490\mdmrock3.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\storufs.inf_amd64_043d7587663e74cc\storufs.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\audioendpoint.inf_amd64_4fc4a632c1490033\audioendpoint.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\hidbth.inf_amd64_b5de0e7e45555968\hidbth.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\hidvhf.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmsonyu.inf_amd64_0e77868deff0b0cd\mdmsonyu.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mstape.inf_amd64_3e2c4fa2d4cbb487\mstape.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\wvmic_kvpexchange.inf_amd64_b3c17aa69dce1e0c\wvmic_kvpexchange.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_71e43a6eaa912e56\input.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\megasas35i.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\vsmraid.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\wvmic_shutdown.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\c_fscopyprotection.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmzoom.inf_amd64_37bf8591584019e1\mdmzoom.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_fsopenfilebackup.inf_amd64_2174d2189fc8f164\c_fsopenfilebackup.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\c_memory.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_multifunction.inf_amd64_8bf0fd2423b20b97\c_multifunction.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmkortx.inf_amd64_93b84ecb5fd1cc85\mdmkortx.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmmot64.inf_amd64_2afbe7d3ad20f42a\mdmmot64.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f6ccd5b2c8226c4a\mshdc.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\tdibth.inf_amd64_01d863816044b9ff\tdibth.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\wsdprint.inf_amd64_ad8fe1d9f235e0bc\wsdprint.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\c_wceusbs.inf_amd64_1ba398d9da634d3f\c_wceusbs.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\mdmgl009.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\mdmsuprv.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\hdaudio.inf_amd64_98fd5b0ddcb79b7d\hdaudio.PNF DriverUpdater.exe File created \??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmmoto1.inf_amd64_5b5f11128afa2611\mdmmoto1.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\mdmomrn3.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\sbp2.inf_amd64_76e1b89751cd652f\sbp2.PNF DriverUpdater.exe File created C:\Windows\system32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF DriverUpdater.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp" GandCrab.exe -
resource yara_rule behavioral1/memory/8604-9973-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/files/0x000800000002458d-9975.dat upx behavioral1/memory/8604-9979-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.92\identity_helper.exe xpajB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ui-strings.js CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms CoronaVirus.exe File opened for modification C:\Program Files\SendDeny.odt.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msaddsr.dll xpajB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadox.dll CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msix.dll xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcor.dll CoronaVirus.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll xpajB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png CoronaVirus.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll xpaj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-math-l1-1-0.dll CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll CoronaVirus.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL xpajB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_selected_18.svg.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll xpaj.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ClientConfiguration.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL xpajB.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_24.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\kk.pak.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\ui-strings.js.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9 InfinityCrypt.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Outbyte\Driver Updater\CommonForms.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll xpajB.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll xpajB.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\move.svg.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png.id-DCF83A85.[[email protected]].ncov CoronaVirus.exe File opened for modification \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe xpajB.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-sq.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\my\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-cs.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-gl.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\app-setup.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\ru\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Notification\notification_fast.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\vendor.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\lo\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1943336206\regex_patterns.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1099773942\Filtering Rules-AA msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-mobile-hub\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-shared-components\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-tokenized-card\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\wallet-webui-925.baa79171a74ad52b0a67.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_261673044\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\lt\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\page_embed_script.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\offscreendocument.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1953310063\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-ec\en-GB\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\it\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-shared-components\nl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\si\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-mr.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-mobile-hub\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Mini-Wallet\mini-wallet.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\km\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\en_CA\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-be.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_881812369\shopping.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-mobile-hub\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\nl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_415656141\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_261673044\deny_full_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_418906231\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1099773942\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1099773942\Part-ZH msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\edge_driver.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-ec\nl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\th\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2024947844\_locales\pa\messages.json msedge.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-mobile-hub\ru\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-shared-components\cs\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-shared-components\fi\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1943336206\v1FieldTypes.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2017106128\data.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-pt.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_1674472938\hyph-sl.hyb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_881812369\edge_driver.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-notification\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Notification\notification_fast.bundle.js.LICENSE.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt msedge.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-hub\nl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js msedge.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 7764 sc.exe 4176 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 9176 8604 WerFault.exe 413 29024 14312 WerFault.exe 439 -
System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ramexpert_lite.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Floxif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GandCrab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mabezat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpajB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InfinityCrypt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CryptoLocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAMExpert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNuke.98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows-outbyte-driver-updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows-outbyte-driver-updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MinecraftInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DeriaLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dharma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nc123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PixelSee_id1663317id.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ServiceHelper.Agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ramexpert_lite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssql2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows-outbyte-driver-updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ServiceHelper.Agent.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0010 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0017 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0017 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0010 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DriverUpdater.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E\ DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg DriverUpdater.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier GandCrab.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 InfinityCrypt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GamingRepair.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msdt.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GandCrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GandCrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InfinityCrypt.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS msdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msdt.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 7380 vssadmin.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" PixelSee_id1663317id.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch PixelSee_id1663317id.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" PixelSee_id1663317id.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000\Software\Microsoft\Internet Explorer\IESettingSync PixelSee_id1663317id.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133885656830674073" msedge.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1 = 56003100000000006e5a1151100057696e646f777300400009000400efbe874f7748885a21322e00000036020000000001000000000000000000000000000000027f0801570069006e0064006f0077007300000016000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0\NodeSlot = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7FD8343-C2E8-0D6B-AEF1-839B2DE42506}\Version\Assembly = 3a22c833043b0d8eb492306291ecde6a3a22c833043b0d8eb492306291ecde6a88ad8cbb5ed3f66b83a8a2cdf194269c890bb34aebd806e41a50d3bd9c0b4765219909f09e75dec0927ff4e8152284cd219909f09e75dec0927ff4e8152284cd59b5414605bae21e9735786eb516d3f8de1283c2aff9bf99d33ed2740c86bbd2f8157495fe950fa4a01046bb55f00dad0f20aa1b1adfe602954529934d03147d Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "17" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0 = 80003100000000006e5ad15010002e4e4554204d656d6f727920436163686520342e30005c0009000400efbe874fdb49885a23322e00000084040000000001000000000000000000000000000000666329002e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e003000000024000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\NodeSlot = "19" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "18" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Installer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\odu\shell\open\command DriverUpdater.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\odu\shell\open DriverUpdater.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\odu DriverUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\odu\ = "URL:odu" DriverUpdater.exe Key created \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" explorer.exe -
Modifies system certificate store 2 TTPs 10 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DriverUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 DriverUpdater.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 24292 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 236 PixelSee_id1663317id.exe 236 PixelSee_id1663317id.exe 236 PixelSee_id1663317id.exe 236 PixelSee_id1663317id.exe 5640 Installer.exe 5640 Installer.exe 4984 ServiceHelper.Agent.exe 4984 ServiceHelper.Agent.exe 4908 DriverUpdater.exe 4908 DriverUpdater.exe 7816 ServiceHelper.Agent.exe 7816 ServiceHelper.Agent.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7128 sdiagnhost.exe 7128 sdiagnhost.exe 7648 sdiagnhost.exe 7648 sdiagnhost.exe 8312 ramexpert_lite.tmp 8312 ramexpert_lite.tmp 4936 Gnil.exe 4936 Gnil.exe 4936 Gnil.exe 4936 Gnil.exe 4936 Gnil.exe 4936 Gnil.exe 4532 spoclsv.exe 4532 spoclsv.exe 6204 Gnil.exe 6204 Gnil.exe 6204 Gnil.exe 6204 Gnil.exe 6204 Gnil.exe 6204 Gnil.exe 3920 spoclsv.exe 3920 spoclsv.exe 3628 Gnil.exe 3628 Gnil.exe 3628 Gnil.exe 3628 Gnil.exe 3628 Gnil.exe 3628 Gnil.exe 6016 spoclsv.exe 6016 spoclsv.exe 8604 Floxif.exe 8604 Floxif.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe 3892 CoronaVirus.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 4044 OpenWith.exe 5712 msedge.exe 1776 xpajB.exe 24292 explorer.exe -
Suspicious behavior: LoadsDriver 33 IoCs
pid Process 680 Process not Found 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe 10704 mssql.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 7152 vssvc.exe Token: SeRestorePrivilege 7152 vssvc.exe Token: SeAuditPrivilege 7152 vssvc.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeSecurityPrivilege 4908 DriverUpdater.exe Token: SeTakeOwnershipPrivilege 4908 DriverUpdater.exe Token: SeDebugPrivilege 7904 DriverUpdater.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 5712 msedge.exe 4908 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe -
Suspicious use of SetWindowsHookEx 62 IoCs
pid Process 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 4044 OpenWith.exe 236 PixelSee_id1663317id.exe 236 PixelSee_id1663317id.exe 236 PixelSee_id1663317id.exe 7904 DriverUpdater.exe 7904 DriverUpdater.exe 8912 OpenWith.exe 6868 SecHealthUI.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 5616 OpenWith.exe 6652 xpaj.exe 10704 mssql.exe 14668 mssql2.exe 29468 SearchHost.exe 24292 explorer.exe 24292 explorer.exe 24292 explorer.exe 24292 explorer.exe 31284 OpenWith.exe 31284 OpenWith.exe 31284 OpenWith.exe 31284 OpenWith.exe 31284 OpenWith.exe 24292 explorer.exe 24292 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5712 wrote to memory of 4220 5712 msedge.exe 81 PID 5712 wrote to memory of 4220 5712 msedge.exe 81 PID 5712 wrote to memory of 2368 5712 msedge.exe 82 PID 5712 wrote to memory of 2368 5712 msedge.exe 82 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 5672 5712 msedge.exe 83 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 PID 5712 wrote to memory of 6036 5712 msedge.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://trovi.com1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x2d4,0x7ffec792f208,0x7ffec792f214,0x7ffec792f2202⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Downloads MZ/PE file
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2284,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:5672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2652,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:82⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:82⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:5444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:82⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:82⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6384,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:82⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6548,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6720,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6448,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6764,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7048,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:82⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7076,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:82⤵PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:82⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4280,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7284,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:12⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7328,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:82⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7176,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:82⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7820,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7956,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:82⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7804,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:6120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:82⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7032,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=8104,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6760,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=7420,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=5272,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:12⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=7492,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:5796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=8068,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=8308,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:82⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=8868,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=5328,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:12⤵PID:244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=8808,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:12⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=9008,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:12⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=8776,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:12⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9004,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:82⤵PID:4584
-
-
C:\Users\Admin\Downloads\PixelSee_id1663317id.exe"C:\Users\Admin\Downloads\PixelSee_id1663317id.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8676,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:82⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=8968,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=9080,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=9292,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=9604,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:12⤵PID:5456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=9180,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=9252,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:12⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:82⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=8684,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --field-trial-handle=9432,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9856 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=8656,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9864,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:82⤵PID:5416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5952,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:82⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9504,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:82⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=9104,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=8040,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9880,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:82⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=9848,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --field-trial-handle=9940,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=10024,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=9344,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:12⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=10216,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9796 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=10236,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:12⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=10312,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10324 /prefetch:12⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=10384,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10328 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=10484,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:12⤵PID:5492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=10448,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --field-trial-handle=8880,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10392 /prefetch:12⤵PID:5528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --field-trial-handle=11116,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11140 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=11476,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11452 /prefetch:12⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --field-trial-handle=11524,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11380 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --field-trial-handle=11664,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11704 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --field-trial-handle=11112,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:12⤵PID:6168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --field-trial-handle=11996,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:12⤵PID:6232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --field-trial-handle=12164,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12176 /prefetch:12⤵PID:6328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --field-trial-handle=11532,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11568 /prefetch:12⤵PID:6476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --field-trial-handle=12400,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12424 /prefetch:12⤵PID:6488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --field-trial-handle=12576,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12168 /prefetch:12⤵PID:6600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --field-trial-handle=12740,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12012 /prefetch:12⤵PID:6668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --field-trial-handle=12572,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12892 /prefetch:12⤵PID:6736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --field-trial-handle=12604,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12804 /prefetch:12⤵PID:6436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --field-trial-handle=12888,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12368 /prefetch:12⤵PID:6392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --field-trial-handle=12040,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12096 /prefetch:12⤵PID:6400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --field-trial-handle=10324,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11152 /prefetch:12⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --field-trial-handle=11196,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12772 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --field-trial-handle=11872,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11676 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --field-trial-handle=8984,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:12⤵PID:6964
-
-
C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7016 -
C:\Users\Admin\AppData\Local\Temp\is-29993006.tmp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\is-29993006.tmp\Installer.exe" /spid:7016 /splha:104620163⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5640 -
C:\Program Files (x86)\Outbyte\Driver Updater\ServiceHelper.Agent.exe"C:\Program Files (x86)\Outbyte\Driver Updater\ServiceHelper.Agent.exe" /install /silent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files (x86)\Outbyte\Driver Updater\DriverUpdater.exe"C:\Program Files (x86)\Outbyte\Driver Updater\DriverUpdater.exe" /Install /AutoStart /CreateOSSnapshot4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4908
-
-
C:\Windows\SysWOW64\sc.exesc start OutbyteDUHelper4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:7764
-
-
C:\Program Files (x86)\Outbyte\Driver Updater\DriverUpdater.exe"C:\Program Files (x86)\Outbyte\Driver Updater\DriverUpdater.exe" /AutoScan /FromInstaller4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7904 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C "start "title" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://outbyte.com/software/driver-updater/purchase/?DriversCount=2&softwareCode=driver-updater®istered=false&language=en&_sid=1XSAWo5N99&m_=0408060440_src_ag_affiliate_du_jerome_medium-driver_updater_ver_3_1_0_40823&clkid=1cdbfmc4u41d6&utm_source=jerome&utm_medium=affiliate&utm_campaign=du_dll&_ga=1916368662.1744092271&version=3.1.0.40823""5⤵PID:6592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://outbyte.com/software/driver-updater/purchase/?DriversCount=2&softwareCode=driver-updater®istered=false&language=en&_sid=1XSAWo5N99&m_=0408060440_src_ag_affiliate_du_jerome_medium-driver_updater_ver_3_1_0_40823&clkid=1cdbfmc4u41d6&utm_source=jerome&utm_medium=affiliate&utm_campaign=du_dll&_ga=1916368662.1744092271&version=3.1.0.40823"6⤵PID:6372
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C "start "title" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://outbyte.com/software/driver-updater/purchase/?DriversCount=2&softwareCode=driver-updater®istered=false&language=en&_sid=1XSAWo5N99&m_=0408060440_src_ag_affiliate_du_jerome_medium-driver_updater_ver_3_1_0_40823&clkid=1cdbfmc4u41d6&utm_source=jerome&utm_medium=affiliate&utm_campaign=du_dll&_ga=1916368662.1744092271&version=3.1.0.40823""5⤵PID:3008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://outbyte.com/software/driver-updater/purchase/?DriversCount=2&softwareCode=driver-updater®istered=false&language=en&_sid=1XSAWo5N99&m_=0408060440_src_ag_affiliate_du_jerome_medium-driver_updater_ver_3_1_0_40823&clkid=1cdbfmc4u41d6&utm_source=jerome&utm_medium=affiliate&utm_campaign=du_dll&_ga=1916368662.1744092271&version=3.1.0.40823"6⤵PID:8720
-
-
-
-
-
-
C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8980,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11812 /prefetch:82⤵PID:6440
-
-
C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"C:\Users\Admin\Downloads\Windows-outbyte-driver-updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13196 /prefetch:82⤵PID:7296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10512,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10624 /prefetch:82⤵PID:7180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --field-trial-handle=12828,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:12⤵PID:8088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --field-trial-handle=11844,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:12⤵PID:7324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --field-trial-handle=11812,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11856 /prefetch:12⤵PID:7796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10500,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12796 /prefetch:82⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --field-trial-handle=10044,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12664 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12048,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:82⤵PID:6852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --field-trial-handle=8260,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:12⤵PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --field-trial-handle=11964,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13116 /prefetch:12⤵PID:5568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --field-trial-handle=11896,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11760 /prefetch:12⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --field-trial-handle=11992,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --field-trial-handle=12180,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11876 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --field-trial-handle=12492,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12412 /prefetch:12⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --field-trial-handle=12532,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12552 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --field-trial-handle=11376,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:12⤵PID:6204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --field-trial-handle=12356,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10436 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10696,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12584 /prefetch:82⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --field-trial-handle=11920,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12184 /prefetch:12⤵PID:5544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --field-trial-handle=8208,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10784 /prefetch:12⤵PID:7052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10544,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10788 /prefetch:82⤵PID:8148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --field-trial-handle=10804,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10780 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --field-trial-handle=12152,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13048 /prefetch:12⤵PID:7544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --field-trial-handle=9480,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:12⤵PID:6360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --field-trial-handle=10568,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11440 /prefetch:12⤵PID:6852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --field-trial-handle=11868,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11020 /prefetch:12⤵PID:6748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --field-trial-handle=12424,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:12⤵PID:6288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --field-trial-handle=11800,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12480 /prefetch:12⤵PID:7268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --field-trial-handle=12552,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11888 /prefetch:12⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --field-trial-handle=13300,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11936 /prefetch:12⤵PID:7940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --field-trial-handle=10736,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11860 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --field-trial-handle=13284,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11372 /prefetch:12⤵PID:7512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --field-trial-handle=9752,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:12⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --field-trial-handle=13308,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:12⤵PID:7264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10120,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:82⤵PID:7684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8940,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:82⤵PID:7080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --field-trial-handle=10752,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10516 /prefetch:12⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --field-trial-handle=9748,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:12⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --field-trial-handle=12416,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13100 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --field-trial-handle=9084,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11692 /prefetch:12⤵PID:8996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --field-trial-handle=11752,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10840 /prefetch:12⤵PID:7244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7576,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:82⤵PID:8500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --field-trial-handle=12776,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:12⤵PID:9068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --field-trial-handle=11968,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10056 /prefetch:12⤵PID:8928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --field-trial-handle=12156,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12796 /prefetch:12⤵PID:6080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --field-trial-handle=10248,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --field-trial-handle=9100,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11236 /prefetch:12⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8052,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:82⤵PID:6696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --always-read-main-dll --field-trial-handle=8824,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:12⤵PID:8412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --always-read-main-dll --field-trial-handle=9512,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12544 /prefetch:12⤵PID:8444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --always-read-main-dll --field-trial-handle=10400,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11460 /prefetch:12⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --always-read-main-dll --field-trial-handle=9124,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11072 /prefetch:12⤵PID:6736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --always-read-main-dll --field-trial-handle=9780,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:12⤵PID:9088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --always-read-main-dll --field-trial-handle=8292,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12920 /prefetch:12⤵PID:9112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --always-read-main-dll --field-trial-handle=11252,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:12⤵PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=155 --always-read-main-dll --field-trial-handle=13244,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11748 /prefetch:12⤵PID:6892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --always-read-main-dll --field-trial-handle=12968,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:12⤵PID:7572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --always-read-main-dll --field-trial-handle=9948,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13208 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --always-read-main-dll --field-trial-handle=12072,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13240 /prefetch:12⤵PID:7276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --always-read-main-dll --field-trial-handle=10692,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --always-read-main-dll --field-trial-handle=9736,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --always-read-main-dll --field-trial-handle=11324,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10280 /prefetch:12⤵PID:6792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=162 --always-read-main-dll --field-trial-handle=10532,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:12⤵PID:6428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=163 --always-read-main-dll --field-trial-handle=10636,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11876 /prefetch:12⤵PID:6276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12544,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12872 /prefetch:82⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12104,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12392 /prefetch:82⤵PID:8320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=166 --always-read-main-dll --field-trial-handle=11416,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11184 /prefetch:12⤵PID:8980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=167 --always-read-main-dll --field-trial-handle=9384,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13248 /prefetch:12⤵PID:9020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=168 --always-read-main-dll --field-trial-handle=12992,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12212 /prefetch:12⤵PID:7592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=169 --always-read-main-dll --field-trial-handle=9324,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=170 --always-read-main-dll --field-trial-handle=11792,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10704 /prefetch:12⤵PID:6904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=171 --always-read-main-dll --field-trial-handle=10060,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13000 /prefetch:12⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=172 --always-read-main-dll --field-trial-handle=12428,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10832 /prefetch:12⤵PID:6896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=173 --always-read-main-dll --field-trial-handle=10944,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10688 /prefetch:12⤵PID:8900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=174 --always-read-main-dll --field-trial-handle=8888,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12784 /prefetch:12⤵PID:8972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=175 --always-read-main-dll --field-trial-handle=5320,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12504 /prefetch:12⤵PID:8560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=176 --always-read-main-dll --field-trial-handle=7516,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11380 /prefetch:12⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=177 --always-read-main-dll --field-trial-handle=11456,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13288 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=178 --always-read-main-dll --field-trial-handle=5172,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11432 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=179 --always-read-main-dll --field-trial-handle=10888,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12972 /prefetch:12⤵PID:7044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=180 --always-read-main-dll --field-trial-handle=11632,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10708 /prefetch:12⤵PID:6172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=181 --always-read-main-dll --field-trial-handle=10848,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=182 --always-read-main-dll --field-trial-handle=12880,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11732 /prefetch:12⤵PID:6396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=183 --always-read-main-dll --field-trial-handle=12236,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:12⤵PID:7536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11544,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12620 /prefetch:82⤵PID:5716
-
-
C:\Users\Admin\Downloads\ramexpert_lite.exe"C:\Users\Admin\Downloads\ramexpert_lite.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7456 -
C:\Users\Admin\AppData\Local\Temp\is-LQPKU.tmp\ramexpert_lite.tmp"C:\Users\Admin\AppData\Local\Temp\is-LQPKU.tmp\ramexpert_lite.tmp" /SL5="$3050E,3032595,886272,C:\Users\Admin\Downloads\ramexpert_lite.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:8312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kcsoftwares.com/?page=postinstall&sw=RAMExpert4⤵PID:8864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.kcsoftwares.com/?page=postinstall&sw=RAMExpert5⤵PID:7920
-
-
-
C:\Program Files (x86)\KC Softwares\RAMExpert\RAMExpert.exe"C:\Program Files (x86)\KC Softwares\RAMExpert\RAMExpert.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kcsoftwares.com/sumo/drivers.php5⤵PID:8800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.kcsoftwares.com/sumo/drivers.php6⤵PID:8808
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=185 --always-read-main-dll --field-trial-handle=12368,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11284 /prefetch:12⤵PID:5916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=186 --always-read-main-dll --field-trial-handle=10988,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11104 /prefetch:12⤵PID:6280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=187 --always-read-main-dll --field-trial-handle=11988,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12080 /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=188 --always-read-main-dll --field-trial-handle=11876,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10604 /prefetch:12⤵PID:9184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=189 --always-read-main-dll --field-trial-handle=9044,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:12⤵PID:6592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=190 --always-read-main-dll --field-trial-handle=12696,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11768 /prefetch:12⤵PID:6656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=191 --always-read-main-dll --field-trial-handle=9488,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:12⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=192 --always-read-main-dll --field-trial-handle=11652,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=9904 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12792,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:82⤵PID:6496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9952,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:82⤵PID:6392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=195 --always-read-main-dll --field-trial-handle=10920,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=13292 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=196 --always-read-main-dll --field-trial-handle=13096,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11484 /prefetch:12⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9412,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=12680 /prefetch:82⤵PID:8876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=198 --always-read-main-dll --field-trial-handle=11644,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=199 --always-read-main-dll --field-trial-handle=9896,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:12⤵PID:8868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11604,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:82⤵PID:7028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3008,i,420558394915545637,12133268413599134078,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:82⤵
- Executes dropped EXE
PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:4696
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:3644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start2⤵PID:4376
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3520
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4044
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\6663e4e2c01446f79551366cac53c9b5 /t 4004 /p 2361⤵PID:4384
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:7152
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:7636
-
C:\Program Files (x86)\Outbyte\Driver Updater\ServiceHelper.Agent.exe"C:\Program Files (x86)\Outbyte\Driver Updater\ServiceHelper.Agent.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7816
-
C:\Users\Admin\Downloads\MinecraftInstaller.exe"C:\Users\Admin\Downloads\MinecraftInstaller.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236 -
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe"C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6600 -
C:\Windows\system32\msdt.exe"C:\Windows\system32\msdt.exe" /id WindowsUpdateDiagnostic /skip TRUE3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7656
-
-
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
PID:7128
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding1⤵PID:3764
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
PID:7648 -
C:\Windows\system32\sfc.exe"C:\Windows\system32\sfc.exe" /scanfile=C:\Windows\system32\Qmgr.dll2⤵PID:7848
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" sdshow bits2⤵
- Launches sc.exe
PID:4176
-
-
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /reset /allusers2⤵PID:8212
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" start bits2⤵PID:8308
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start bits3⤵PID:8332
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:8912
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x300 0x2ec1⤵PID:8556
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:6512
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:6604
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:7948
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:1572
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5196
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:6868
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:2056
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:6244
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:3460
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:3128
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5616 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\README.md2⤵PID:6216
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5836
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"1⤵PID:6840
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpajB.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpajB.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1776
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6652
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Mabezat\Mabezat.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Mabezat\Mabezat.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1652
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4936 -
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4532
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6204 -
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6016
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:8604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8604 -s 4762⤵
- Program crash
PID:9176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 8604 -ip 86041⤵PID:7032
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Browser Hijackers\BabylonToolbar.txt1⤵PID:7776
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3892 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:4856
-
C:\Windows\system32\mode.commode con cp select=12513⤵PID:16360
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:7380
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:12596
-
C:\Windows\system32\mode.commode con cp select=12513⤵PID:8796
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:13676
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:10968
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8340 -
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:7312 -
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002403⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe1⤵PID:6412
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exeC:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7172
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2832
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\CoronaVirus.exe1⤵PID:4992
-
C:\Windows\System32\CoronaVirus.exeC:\Windows\System32\CoronaVirus.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6040
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:9948
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:8356
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6180 -
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
PID:16112
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"2⤵
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:10704
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:14668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:14476
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:27436
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:29468
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\GandCrab.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\GandCrab.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:14312 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵PID:12948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14312 -s 14882⤵
- Program crash
PID:29024
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\InfinityCrypt.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:14276
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Windows\System32\Info.hta"1⤵PID:10928
-
C:\Windows\system32\mshta.exemshta.exe "C:\Windows\System32\Info.hta"2⤵PID:2280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"1⤵PID:10912
-
C:\Windows\system32\mshta.exemshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"2⤵PID:18684
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10228
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:26776
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
PID:18672
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:21332
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:23636
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:24292 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\KCDSQSMIX-MANUAL.txt2⤵PID:28980
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:25316
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:26244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 14312 -ip 143121⤵PID:28180
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:31284 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Windows-outbyte-driver-updater (1).exe.id-DCF83A85.[[email protected]].ncov.kcdsqsmix2⤵PID:31888
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\8a2adbc84f1543a9985e9a8d22af7644 /t 31804 /p 318881⤵PID:33324
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Impair Defenses
1Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b87464b97931d6f45823a1a52a75d017
SHA1a95e82a5a74292d758030e7d123a3adf2cf1027c
SHA256bc69f86601bf8c6e528d8c92d227560373a56dca5688f57dd9292ba1c7f48dcb
SHA5129974e33a2f074a6e5afcc2c88d2d3e6e982c3887414e30ba29cada68e63d2ff8bf5edb840da62d47fe6d26267043edcd2915c5d937327e037ac68914817cae58
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9
Filesize16B
MD5cc03b48d916ea39a9217a258e63f55ea
SHA1819a0a6a902c8e27d575a5b5fe8f25e187751297
SHA25606403eab3d401568e57685cd4a2554c27edbc383c929ca3b527a23d92ad2c763
SHA5125468e58c106a64cd3484b047d9958e18e575d4f91a6b1c971abde27cb57146022ef4ab8f32311c10259060032f00dfc1bd36ccec2668e1033917ddb18a3f801a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.id-DCF83A85.[[email protected]].ncov.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9
Filesize6.4MB
MD5a5406bc0015894bcc4cf49ee0610d867
SHA198e8e6a3e749b42620fd5d8de969299a9135acb6
SHA256a78469ba3c7193cbaafabcce02e308622f13ed286e6700bf0c01759b67f177ff
SHA51251d89fac2a48815a4375b36db5f589441f127a5b9366ede45bc0b5165c2dfc0d6a087c21da17e9a6656802c0bddfdcf7088c771669f4e511d48d55d3b8aa7cf1
-
Filesize
1.6MB
MD58d714515862e267b9c39896e03aaaca4
SHA1f771a34bcc4061adc82c1151e65e0f20d2c87d14
SHA256db6c6aa4ace6a2cb863d104426158c56cfee0a68667f8274871bfc60d5f01904
SHA512f81720f102ec43f238585ac6fbd0231fc722b82b6068fcde3feb1bd9f36d7ac84985500e22470591a95914365be591d54d98cc7e95f8c0760711cd73e6e1768a
-
Filesize
3.1MB
MD5fa2e39b1ab845e01201aba503bfed842
SHA1d6f73937239e3b7ebe48584a543e72912db6d5e2
SHA256384dd0ccc9d8abf3459275d0064cc1dbf2a24429f94ecf966611cb6c65674811
SHA512ab3db8cb7903038687bcbefdb8c55365d7c4dc72a5f2ad9ae1514944fbc8b6adc67267e6121b8d16cd6fac6a22d8c60829579897fd308f0274e95d560629769a
-
Filesize
8.5MB
MD5c5bb0e3acfcbc05d1d084df0cbcc778b
SHA19213f51b5f8636745c837413faa3a63ed088c27f
SHA25685b259695a8341ebcdfd061e2aa561e32ec037b1949af1c93115af498d87cebf
SHA512db8de647d7c2b62795774649a241681855654c7b7a926d677a1ef6043c85c3d34438cf7a123b5c5859d0cf3dbc2efd9ce7850d7c9cb5bf1c7b14d146550d5c18
-
Filesize
72KB
MD5ccf7e487353602c57e2e743d047aca36
SHA199f66919152d67a882685a41b7130af5f7703888
SHA256eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914
SHA512dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-DCF83A85.[[email protected]].ncov
Filesize2.7MB
MD56434abb2a873c223e127e4f8a3ae45cd
SHA1096a42aaea43d77a2525c7c4c916626910827189
SHA2561ab766660a21f0a3558bf3ceee773afd90991e22a0ac230175b60b742f992895
SHA512ac3d7c1d14a52403358ec9537aa159a4ea32ab9fed42f50a72bf83c18a374ddf765f0812d5877f57f3ed640f450d4e5f28f55869a291afcef5df6f80f737fd49
-
Filesize
1KB
MD53b9421218cf3f11337d280ae8d24d4af
SHA12fc2f8b3d389ce3ed570e8684c4e216001314669
SHA256e7c1f90a590273e78f6db58719ba5fcff2b91663632eb9c2a0c1f62f824e1664
SHA512be674c944acd1a2e320e4726e451964c175115f7bef1ac3063bac6c068f35e5ccadf5e8464a6fe31a1d832b22f55de8d3524a890e5bb4e09cd5303acbc50b8a5
-
Filesize
44KB
MD5f3f48d192c36cb2e64ee2f9a4a192ff3
SHA1dda527448bb0e482d5049aa80d0c69e76bff7939
SHA25685422cf6a7dbe897b4b3158006b32f1d82ca87587ba94feba73fb632ab663238
SHA512be8c158365e7bf600bdc3487b158819fe5d3594a8193ad9ef5e8cdcdd8fb6e755e099bbf6ddd73bf08d1c173e4448060b548625fbbc23a02bfd01d11bba12919
-
Filesize
282B
MD59fb1919252324a430154bc4e3591a873
SHA11676af8792196e1c338000f3b181b2371489dc51
SHA256d2d387cdea429a7c2a48b000e4badc249a555a11130f12896dd64d738228bccb
SHA512157a87fe809845e44890c29c26572147447d7e644387a70e06d4b56fb2daff3f6c5982df47faa494e3584509efe9dbdc24ca9eafa230e4291c6c2501566c6716
-
Filesize
40KB
MD5a31717593e39fc930b6bffdfc338f081
SHA19e81ab767a6e9cfc38ca53b160bda024750bb71b
SHA256cbfb84ce03cc3ee5fda39d0a74d14c18cbd823f6982ad515727a1e8e0093f9c4
SHA51235b7da09c604ad8ca27c4c50cfbc7e4ff28b00ea6d20ebeaa44edba781fac2478863450e142183c5253f99696bcd2d051870100ada0f951b3dd45a93615b4c2f
-
Filesize
280B
MD577532bfc14c90e92c2c117f6625e41d1
SHA17ba952d5e18485d66976547fb8f47b2aaffeab80
SHA256587fe94912145359072577e01c7fe95e0fd4e6972e35f0a6a4d464382d8237f7
SHA5121b1b9ed2c3012cb6371b05681acf995a15feab32f0bc860bd4c441c1a1dcd8bd1a9fc7985fd10c16674ee7423a86c479a241dd5d1c843fb70962504db0eb82a2
-
Filesize
352B
MD5fbb4871d58f23feb869453f956fbba3f
SHA12c4e22024fb029084550ad24624abb94a2b68070
SHA256dbfe433dcebddcca4870c946b7a2e5135e5bdb0c50bd68db870bd332ae7401a4
SHA512c88fb63ab015d88cb1072d8dd912f9ece93818ce308b1536b55a93dba5cf6aa57e24108db88233019d9ede07a2b45bff5150d6c60c2ac1844352486587703aed
-
Filesize
7KB
MD5feecf3e2e9937c940554ba277c387743
SHA1497568a4768cfe9d9263951b06876871e76ff2d3
SHA25623e57eec39aaae44ee607180afc5c404bbdaf82becfd9f9c77424a73735915b0
SHA512f3405875daf08edbdcf0ccf128564b3f89757cc6403508119365bce8398ca4d5bbb39057994c19cf6f616cf951373945a7bde2276403f831cfe84da3853d0f35
-
Filesize
110KB
MD5856a44c7e5f305d914f73151e46348f1
SHA1ef7198fffde31f348f41c1fce450f7c83f2724d4
SHA256f576eb2ecc60fe36e8222e836af2b7a7fc0e2f757159e970631eb2e496b0411d
SHA512c429e91a2cc420bede1768600604b9e3695d0f29640da2880ba9c2cd528fad536b63e40e142c48275b21c3607ea3e5677eee2c2c4332c894ff70687069dafbe7
-
Filesize
58KB
MD5df4d705e328e9d08df3dfa7393827753
SHA1cf495fb71a8bcfbd9fe1d08dab0a559636774324
SHA2566cc032d7a603a12a0b3a1ac5bd434f34341893df45f6bc0eb9609056b08938e6
SHA5122c5c12baa0fc0aa5cd4b24fbd1eb542f26bb45d0c5ef15426f497d853502b38df181527fcad5d9b913a64acde9b3a1b3b72212f6765a8ce0935259161518e473
-
Filesize
17KB
MD5a673a4ff37878ab1cb36ed1079a6e033
SHA1823159a712bccac71c5dbadc14f30b4f3592f424
SHA2569edbc2b7d4862beb81dfce14ae3ae0cc1df4359c2b535a79c34f4cc5072afa17
SHA51202f70f2c2441337733ab64539299f1739248bfb43aa4fe00dfcfa558d6b4ee8ebfec28a2146554380f759174d7b4f0d55056bac251a3e870d6fdd211c3c754bf
-
Filesize
19KB
MD53b25fbd9be0594e7d5dd630003ef4194
SHA173d1b16b7b95ec2907407f06c3f353497e29a362
SHA2560ab699ef1483cd423e0880e48701eb0f38d8d250a4f7e63262a5a10e587f6df1
SHA512137ca7a8f12319721e9ad5a729c14c14cd560abad62366fe47d2742ed30e9dcf5f3a3c1c5607deee579ba9407ce5b5c1c737bc74e07e64dee65e1fc2ab8b0615
-
Filesize
76KB
MD5c99f966767a99c2971aaad4890f0d323
SHA1d6dd4e0199e653bd6663c5203dc3889e9b6c0baa
SHA256ad5f0de938a628df6b0de66005e92497bb39c09fb8491ea7fc4d5afd600262e2
SHA51202475dacf307541c4e2801b2e849585d4210990fff97bf5afe9f44f5ee46ae8ba21152295cd8baeeecba3005250d81e7d280007f0b8f57f77247a3e2588b7c1a
-
Filesize
163KB
MD5f530580440e1ecce28ec8fb92ccd57fa
SHA14053d67de49c8349f86bca8f2ff7f352ea217705
SHA25685d0261f7eb33d9bb3bd679d305aa436d1d547680a6382809de44d7e2a4dfdeb
SHA512039450149fdd8d40d4e5b3f9b57bfb8e4ba3f3e3ae8eb21308e5b50d6b73801b56c27550fa60158a36ca02b56940f23db9016af296fc2e1f6b728698395299f7
-
Filesize
64KB
MD50cdf3ed0f9e33c60eaab0dc63bd7faab
SHA120c5aadade28bab3a27743457140bffdeab3b3bc
SHA2564fee7076cacf49b6e7b9da33cd6f61597b11d81461d92e5f2edd5affd0c01c99
SHA5125ba3e530f61e7246e72cc2839324d7bc36339f080bef5e778d4ed2c1de29dc227e195dbe98c6bf77a224097dc8af111111cb9c12c204a471fa5f816e27082b21
-
Filesize
128KB
MD5b7535131f7cd7bc821983415700d2b05
SHA11fe876763579951dffb7ed96621a273c2ae9ec06
SHA25643478662f9df5c530383ccafbbfbafa949efddb4dc50b9765dd605e5e19b9c6c
SHA512bab5cb0b3fb670d6fa1a0028660b77928c77e9c9f79d4d950e50832371d3692e34fb295f7a8f3db96b4bf102e7a3a374c9ee4391a010523660d19fdec7af9675
-
Filesize
71KB
MD58f850aaafc8da0df7f8f0a0b682a934b
SHA1ef55df2e866abed76fe19b05ceb51c1147a6961f
SHA256d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
SHA51215160500824282d1e829908670dc7405abeb4d571ffdcf94532f55294fce77552c832f27fc14b91141ffd2aa142c441fd8e48df8e43cdbfe9283a043da2460dd
-
Filesize
20KB
MD5cb03e9903fd91a7313014a937a57c6fa
SHA17dbf327fc06a4324927003875b8e0ac05a0a7761
SHA256798e4e4d15a36f12b196908676d3891e8b3e8d544298d55a4a5254d341cf061a
SHA5126482dc34e1aa7d3f447d2ae71573ec769ffd32de4e42f4103db2e58cd954dc89d3633d9ad150a6b437b5a2a85444505a276d2241d1cff9edd3496fa3a1f3b582
-
Filesize
57KB
MD5c912071d873e51428b22856bf65a5be0
SHA18094e085c1c90186d9ab4850397caa60c64e4f05
SHA25617a729786d4a2204d3a84895e45a4508ecc32cc0937f93daa112133f0bab3ae9
SHA5128c22a8f2536e4d19c2189214228f604b9e72ef18ef60da6b58e1a972e9934ecd11dbd91ff8052f22d21f9de7dd13fc701df09782dbf27a4253c9c1bc43386b70
-
Filesize
128KB
MD565017bece88c19e29f6cdaec270813e6
SHA1f7485eede0b853c9077b971fa9f93228f8574682
SHA2561701d1f49a284370f689c693883eb345f524e7f87e08f3e1c6889109f1639354
SHA51278fdec2afb2df625886e0a5ecf6b325aa3451d19f762db473e9cabeb38e1d3474f01463ead78ba177d8eadbe6c8ec6ab1718e91e6bec2c6a8dc65e39545a0e85
-
Filesize
256KB
MD5d50df859fac0f2587beed99950a55382
SHA19389a43a2661575dd5afdbf9f4521abffb9be4eb
SHA2560f1fe568a93ba617348d6cdca8a12cb85e4ea8f6f6ae3cce1cd0b8fbed3de935
SHA512b7205c1bbfb83c07a08241c106678c79f4062e1c700f2c61f71ab7288c89700a5fb13e733e4c8e3b9f12a68dba1365674c9b940af84f95bce7a38af4f1618195
-
Filesize
61KB
MD54bf633264d973581795bcea336ffd2f7
SHA1ba917e33ab24035110a18f0c9e277c5785233dba
SHA256e2b012f9951771c03e58799a290967d8cd25f84d20c0b1e237465dde6cd4eb32
SHA5125257c3ab0e80b3717563c0b504ba6cd7102bf461454500d34a999034b415092c1fcb1dc0f4f18efadcab203ae1019de2257739c3bf7cb56e3f87177a9a5a860b
-
Filesize
16KB
MD51a5f77ed442e2aea0bc5209866169d1c
SHA17ee6391914853f005debca8061a9666b709f585e
SHA256e1a04d48039f08ced4ab09bb4dc4034d37661dfe68835459548304a675751d0a
SHA5124ab6297041670cb91a93ade97b0860798119a15272b12a35cb71eb6a7183419319062ef7794b2bb019913d747ea0d5073abed4e430ccdeb6d5f17bc226a1ca0f
-
Filesize
17KB
MD56793fa249dd0a792d9dcbbff58116244
SHA194b552bc0c89b6bf18275e90559ebf0ab038a817
SHA25604acff19eb7dabe3daea20e107798e785b84f8bd57d8457c75ff2e587c392beb
SHA51276623bac3620d530c95c044aa103042c5725c96e54c171f5dab7488d6e5e57c6c52829709b48fb4df9570b0112e28e3b0731c2857cbd02ecb0caa4d73297c571
-
Filesize
20KB
MD59d5e7dfd5c74401ee1a9385a7d43d247
SHA1e781856a557abb5182b4843643d9f8f683e9af98
SHA25685a9f80e25c666d66d274b91574c8ae36771d9538c0e0a6635d7befebe881735
SHA51232752d4efba3923531bbc2858a6cc7d299efb1dc149e3ca26873772fd22234ed7aca3b38fc92698f199945a05fd253e1d5a79f0f9281c2929f38987e640069e3
-
Filesize
29KB
MD5f9833577b2bc1b3a336aebd68e4149f7
SHA18902554009edef3aa413444cf5ba9dc27f6b6fff
SHA2560b7146146e459fa2b79f73be37420fbb5cd8530556f84776fd48fb33485bc5d7
SHA512cae27ca43e42c21449e768ad1b3bcabe2316446fbdc9366bc18b296d16187bfe6f50d18154ecb0e133a772749a98bf20fea9d42c5bda16dbb35d0ed92b73de30
-
Filesize
25KB
MD50e557b74619d8ce40171b0cbe860502f
SHA1dc9f32508d05eedeefd489a6943a5c965d5045c1
SHA256d089724b4d7a6ef35e4480bd0b36905c5d4730fe10f38ff823f64795cab1fd01
SHA5121d39a493fedd8f3b328dc3af00586ef0c57a46897d03af3bc84b37af131a4fb8e78f56c517a71b4674369b22e08b48a1a7a055c494307b99b37a88ccab4900e5
-
Filesize
36KB
MD5fa600b209edc9962633faaff36e38fd7
SHA1f854d811a33b3e451ea2a95efb10fb0c6283fdb8
SHA2564d14cc2ad1ec730a5fa4cd942494fd6bd0164ca80997e82a84b709e4d558557c
SHA5125443c101cdfc9c1592c796e7784a539e91abb4931332cdfe4b2acf0066e0705d4c7810659094eece5123492e15968c6c36180d35007ea3e418c4d25979e9c05d
-
Filesize
73KB
MD5d761a2641c7d9bcd36a42e0f85253efb
SHA12774f4713c9d9d0034c9cb9cac70999ed1063097
SHA2565b663b558de32463b2d69829fd79bd54c2c52261b35b5a1327b437f22b12cf4d
SHA512f4512127ce24872902dfe3a6319ddb28bf43f153b6e9b3146809dc0c141e459f0fef32ec60cd26b0d450b14372e15c30ead9346f51bfc1b549f934d063c8413a
-
Filesize
17KB
MD575a4da290967c887e32d308da10ba5c9
SHA14879ce607f24fdea62ac2b75a869b8605e923b3a
SHA256e81efe93af08b377de78c8711c03a84390e8eab67231cf3eb762dc300158413a
SHA512f747a5594170eb859047a8b01b7ebbe00a5367d61a746fa0c20eabe53e342a7b419cdc69e63e165f4fda70245be3c65fb10552d0fcaefbc8e84100c22e5fac89
-
Filesize
134KB
MD52ea86888cffdc9fa78756dc2ee6877fb
SHA1450b2014d256f4f488f8b35e918c676177aad157
SHA256d7cab57401d560fded725fc6c3daf444cb1897c578f422936153a5fa6d1c0d61
SHA512f8d72ce5d3cafbb6017acda7dbd70a0751688a772e0ba5deef76bd659f146b6274143e629b82c9d0f21c07787704cd32820efd0a88e8c883e03080a19f59d077
-
Filesize
49KB
MD5454dbaea6069ee3f7891857e12cc7501
SHA1925a86583804c24b93289ca072bf7c557090d64e
SHA256bd9bfbad4af10b2c7d81d626b2f10085c930bdd5d0f7ab7b292e139d46fae005
SHA512a62d9833213f5c26c0dc04074f946f94a3f928b5cb0f7f77555518047a0f8c26533fe730fe7b6c032e5179d1d06529d05e388076987b58c50501c260ad4b6335
-
Filesize
62KB
MD5c813a1b87f1651d642cdcad5fca7a7d8
SHA10e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA256df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
SHA512af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
-
Filesize
70KB
MD5638b28824ff7d2a8b5eca31267ffaf3d
SHA151c91fb5de5248d6dbbe194565231c4bbbc197fb
SHA256a2477313b8f9735a83fff20ff6624d26a13c893601a3cf6148bc997022913011
SHA5120eb506d4d9f7bf3aef60dc2d69135a1eb6c9748eca15f721cf5310a7bfe131e21c3504dd75ad986ddfcde907cedd8522caa64845de1794000c2fe7a477189af5
-
Filesize
19KB
MD51bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA16dd8803e59949c985d6a9df2f26c833041a5178c
SHA256af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
SHA512b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
-
Filesize
63KB
MD5226541550a51911c375216f718493f65
SHA1f6e608468401f9384cabdef45ca19e2afacc84bd
SHA256caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
SHA5122947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
-
Filesize
26KB
MD55b2c167b40090dd61c91e4f1ca7a2ed7
SHA1358a3374016d18b77be8fb5467bb292afc6c7131
SHA256ac36fda471026ae8c423bca5878991bc001df9f0a49a6983740af5b6d4d42671
SHA51265dc0d8abf145a748ada6b1c74a449a6f102314d4afe840b3e3312415b04c008e4e7b42ab0b2f727fec7d83bcc0f2b5920dda2a42aeb1ce5de3aca204e19fe17
-
Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
Filesize
4.3MB
MD5df9b0a614ea4e7d629cbacca8ec74cfa
SHA10e1cd42e9ecb09c3dae44c73ed53a9936dcca2bd
SHA256909f25010109d860940d6ae6dff8704557a0f2e656d63a34f277135f793120c3
SHA512741664f9b7b7c2b5f93f90142158c57c13cef824c070e234e38ca1fd56854d2608d8fcc17012fbea0c899be2b574dc51900c342fe704c53640c793e049ea1414
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
24KB
MD5cc24419c482370498f3c227ac73d666b
SHA137fc103ace873f47102e0ca88eb4735bc6806750
SHA256152fa070788f0cf29dc062f03860897c39c7ffa13e6eee2dc3e5dc131ecbc7aa
SHA512b70a76518fffc215370e5de56122763b54377cb52875c1ce0a87dc7a24aade947d8c412b27e879a172b0de76d9ac654c3d358a45c79ca00f20fe3c4950c6c55c
-
Filesize
28KB
MD5808b127a9c168c9d32389e0ea4fbebec
SHA1309674b1e98102e70ead8347fb9ddfb5093b40af
SHA256f7a18b06d8d4ecd38abbd837a954bcdb5538b0b1bdfeb2d9962404b9ce70488d
SHA512bce1846c1b498c91f3dae4a4a7ac97a992d0c9155c6e23f3a69c29f876eb420dcd7f426f636b3b6bd71b5693e44ad0383bc3c4e5c4295ffff3496f3f10072f22
-
Filesize
20KB
MD52a7106aebd02afff16e9c22232b5ae07
SHA1fca04481906a4e2c0130e9e05a65ff2c31d66045
SHA256755e8b23ccf8c78357fdcfc52f1476a045b4cc70fa65b59b314a89c9772ea4d8
SHA512913f410c3ca4d4f82c01e0a075e7a5c00a1b7486057bf53e0765225683e2c43b28a59438b9cc0b7bf367afacd818e6e7d1f778db5ae8e102c4c597abc96767f3
-
Filesize
43KB
MD5f7bc6d476cbe58004904729c28f2df32
SHA1a659287161a18f5340f3546c5210b5cdeb24cf24
SHA256a2890230c090ce1830a1bad4013eb2f2b9fc2b415a57eba9a8c8b8ed048bd13f
SHA5127fde02c8aa4931c4c6cb162b767c7df29c645f5a3540af49c65ce0e9a78520677306c9b41e8fa03f9e480f1ca827a825885c79a8bba9c25f13565699e7ccbc19
-
Filesize
24KB
MD55e2c9780d1071e9ae93e3c58565111f9
SHA154a61a011e916b59a8f0a3760abf2c5914379eed
SHA25683958be478b426a226b0fa01d7e8b6726a64fe09701134f93c145e4f11d9b2d9
SHA5120f624d6bf8a7a78d0adf5cd7c21a26f9e2da527fb611be434154fa97f839170eab4d3667db059a8650e39b6ab45d99b49c781c5f1be09d18b8ead66767088010
-
Filesize
52KB
MD54dfc732aa289e8e88db9e55a04968575
SHA1c3d131bc56adc184529e7842397871d1b7839029
SHA256a5c25f27553195830226821a6c35486a27cb65783b4861d80220630a34d65fc8
SHA5120d5abaa8f5987d3a036306c20cda769ff8603e67fcc0286a109c8bdda5627c364071963af58fe5ac87af86209886be072acee3dc8b17d724e6fdf70eb3a57c71
-
Filesize
241KB
MD5764d1bdb924121df986d998e349e8e86
SHA1dee0fd2aa0f0eec43af27dc67cfa49de4a75efba
SHA256641d0962555c1876ec8b6b982bc7741ec7aa252275098da4c0b17635ea21a4dd
SHA5122ed0e951a623e510df5cb8f8c8c34ad25df4c2ed0037ac20973eac9d932b18bb340d1a71f7cf99b4cbb3e93455397fae2ef855c5fe77fe57c9370ceaf7bcfdef
-
Filesize
149KB
MD54f41426f9c39193aa5f4e67054e715b0
SHA158cd798c9132d3a7c283f2a91bac6daed4d6460d
SHA2564190fb8c8fb184a0fbdf2e8df265699e57e28359aacec26dee5f1bde0b1b76f8
SHA512b8750ed8da51881a3970cc7bd0266a3ddc7aeb6bf1ce9d41f6485857d1eb0fad965f1ff789da8f460df79634fab3357299bbb82d3ba2197dbcc9c94897d95276
-
Filesize
49KB
MD5b504b8d416417d9c6037fe7f90d5f9a8
SHA153a860a8c6da8e0a496fd44e7e1148e5cee52b98
SHA25629ceb904251a26109b78354a2af335490944843a349a37ae63b1178ae793f0b5
SHA512cb5bb106eb8acf6c7b5c4cb770795919ba67e7ac7882f036d1d69090035416b901ba3c374b4c74fd6f08f80d9cf82b8c6129e7688a3e74765f08813fba814c8d
-
Filesize
60KB
MD5714279718ca6cca7309186501204591a
SHA1e9e34e90b3dcaeee028d9cff4ce395e597773a76
SHA2566088c8cddb4615e35c83297313dd8078992a34380f49edb0b54fbae0dbd48ff9
SHA51245244be894293b1d6f8d55251971d545dca8277d18fdf4803698aa75ec92886b03c7dc2bac8f875919ff83d9a3120e97ca2a0e3edf703d9e62c6ea90443fc870
-
Filesize
23KB
MD52ba871fdffd1ef555ac035cf9cd61427
SHA16c96fa7b4c995a128e12c4e740a0a811b7322db8
SHA25655907923082f19bf814ee763902562837eaf18514d24c68642b9f8df4435ffa4
SHA512f5b6348209e39c574cb48e6c2eb986f8fb2e1cc948fde722d566f727a25f6da649b81592d185304a4b88a28c1a1076b60303788f50edf9989eb079b34b3ab887
-
Filesize
32KB
MD55cb8f04ab1f6c554c43b2e2b6cbfe070
SHA14a6849fb511ab05285b85027f95c6e4e5991e68d
SHA25692d29d17fa6daf434c2a693e02de43bc7ef1dc5c1dfed87eed0867100397804a
SHA5121e9d87d7d6a9a5a4eb4d62d7d40235e087eea3b77f65ae6849d0b5b90db23f0b6715dee2a12b85d85d3092b6fe91036f19f46817f8285c160eb64e7b60f8e542
-
Filesize
28KB
MD5800c32264c0d679253dbad24c625638d
SHA107b6c5bb8b1484235d0f5904480e161071296668
SHA25617f171d31dc298e260c24e05d3dffd38a366aab8dc69ec845595898900a0f754
SHA512050e2bae5fe59185055c965db030dcfe38556d1a0dbe49b0a5db96dce0b14318ebdee7e6ea717010a4466b8d3b8a4f64d991964ab42b7718585b244d40dec7a5
-
Filesize
20KB
MD57c6f5fefe62c49df01173bcb7dfc91dd
SHA1ede6f3876a05d575340ab13c393b64ffdfd25dcf
SHA2569dd2b71ffe36ca9e3160a7446685022c63265f3e1a8fdf9364fb14e9dcc8a449
SHA5122b57797297e2f50b4f46162b80f0d21abedb39450c591b3980149b609ec285e1425c44890d4c38fc843a3d6451c2685c091fac31b0cac93605bcfbf685b9b114
-
Filesize
67KB
MD5fa93b0e475f5d31e5c14ab951028b93b
SHA181e85721e1640c66788d720a4a969ca4788e26fc
SHA256f100447f5f42e635b08d5ff132eb9ba8f6929a9db8a2923b4321ebfffb905246
SHA5123e017a99f654115c61b650f44f018a16e02c91b81437a4b97ffd345c31597ea38dba5fdd5c14212b261c727555c7f2ebbc24b02ede8bb6c11d0a7ac45c1b06cf
-
Filesize
62KB
MD5f9f02c0737a882fc2fd4c61bc199c32f
SHA1e0c462b665dfc9defe56ff383710ea7b395f2470
SHA2567f45eee2684ec4df372e914784c00430409c9206372a9d4f12a076d42dd975ab
SHA5122e73daa8c71dd8a30507deb1e61e6974e49b4b83e71910e301470db6c809b22a6b5c6fa73fa65a6060b60da5d0e72c0d4b7697446172735b787eaa6695fbe4b6
-
Filesize
92KB
MD5afe2251c1fc9a8cab2d53fdc81cc877f
SHA127a2e1eaa5a4c0bd85b93d8ab8f25bb55f0f8673
SHA256a098757c5bf12038fed17949fa6b81c70cf7e6615122521ab4c7ca2037ad2e6c
SHA51203da61f87d9ab7d67fe005d8d68aa91e2420bbb525d407ce721017cad4d3f0f0ee65851fdd4bf689c4db16d151f3b18295da9181c29d190ead58106939ce9e8c
-
Filesize
86KB
MD5d99860834aac3f047279fd2f3dfd64e6
SHA1198ed3d025c7e2b854ddc5d160baad36c4090cc0
SHA256bd6b4f45d8ac2082d01be79abf50210bfeb1569f3fc03f8eb5682fb80ddfd2e6
SHA51249004e52f5d50d9b5662533ab7c8bf3a9e546a8df627af26a138936297c6be964ed498c8b0b2bad9b88b73770aff402464baed9fda5c22cf13b60e7f728ead53
-
Filesize
16KB
MD59c6b5ce6b3452e98573e6409c34dd73c
SHA1de607fadef62e36945a409a838eb8fc36d819b42
SHA256cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc
SHA5124cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7
-
Filesize
35KB
MD57c702451150c376ff54a34249bceb819
SHA13ab4dc2f57c0fd141456c1cbe24f112adf3710e2
SHA25677d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583
SHA5129f1a79e93775dc5bd4aa9749387d5fa8ef55037ccda425039fe68a5634bb682656a9ed4b6940e15226f370e0111878ecd6ec357d55c4720f97a97e58ece78d59
-
Filesize
39KB
MD59a01b69183a9604ab3a439e388b30501
SHA18ed1d59003d0dbe6360481017b44665153665fbe
SHA25620b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
SHA5120e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
-
Filesize
22KB
MD5e8cbc6bee6ad98ab3106aa789655515e
SHA1fa5b85351a86f96a4aaf527ae6ce275f1788b904
SHA2562b30ba91f97a947abc519f55c7851e4c96a48a86f4739620642b0644494c4ba5
SHA512ab3337457fda3cbb2fd4f396add7beb8af3fb9ff17e4776d8fc154af6c251ba82fb6c6f19209e7dfd65fa7665d17bc2595ea21410af0f011b0fda38628529134
-
Filesize
67KB
MD5b10036999cd15b80eb3a4b43ea1ecc21
SHA156868b159679cb462733329ab0e817244747126d
SHA256f86f2f5311fa540f4983854a7822c81201e167d2d8261d93faabd6bc84d39fe3
SHA512886382ca26b55b715d9d3c43a5a49efb863ad6ee6ff19324147839983f225e2d31d24836f4dd5d6f13093fe44aa23e8f16dbf0477b9ca4c1c0e6725f66873f3d
-
Filesize
103KB
MD59edcc600cc416de53ef3d89626fbca17
SHA1371f4a78c01474790f0229c6c7531fa19c1818ba
SHA256879c14e03427849e33ceb480061f05ea4190747665dd6efc40c147fb448ce6c9
SHA5126b30495d075f407b47cde29afb8101873f3edc9b1134ba125d3995aaa6357482cda40e13cd359510c30169329995494749131a215eba8f2f3b9e69c4beaa13e9
-
Filesize
137KB
MD54e8c77596f36f045c8e5a641e46eae72
SHA16e6556b339c9ead5d400848330b07fdf5501020c
SHA25616df749c1cb18e768cdd10e34173848d0e6c96300441c1465173292a623874b1
SHA512b8c9c0c1c61bdd5794eebac881c39268378e1fa64cfe92237148d53e85401a50e20520d9bee0880c7b2b6c0194e844b4394af15d811445430c1fc76eafcf6718
-
Filesize
29KB
MD54f67bddea4a4b56fa44f7cfe3d8e17f6
SHA1438d0068eea5ebebe51681e9a99f4ea32cfe15e3
SHA256b12c446b6906a8955e13fba049813b7367342208f2f605e636bae8cbb7c2a847
SHA512341ad30b36804ec19a0299e99e95ca576474ea85eb853f986f0e8199481e5e5f6826d71ed660f408b0dd7bce3e2d28e873e64799a24c5803247b7ab356a276be
-
Filesize
75KB
MD590f806d4a36f320f17daa144184b2000
SHA141cf3e446816aeffdf12bde8b0b9518b26a16f02
SHA2564a48464b3583c5c951b463a8d1b0520a7619871a3dc07f61b1b14491ef8d672a
SHA512944fc14c9f2d072b3e8cd2f93c473df8fc3e568e0d04ab8defa77465c848589848b93c1a506c63e12fc57fea16140e8607e4ec241b3e889b4f64b4794812c2da
-
Filesize
46KB
MD5e1b283ecd774735e8c12015c77cd5bfa
SHA16547b6ed457d7c8b72bb18221a48995a2945e3fe
SHA256c03d99c9407c075f452c83f31aee45389e4e40aed75c4c0fb054ab3a207ebbe9
SHA512edcbeeed6cec16ccac1bc9c75a3790bd68f88cd74ac8efd869e4d7326b451e439c14b5432938074114241836505d29704a6941ed35fa50d0eb0a65c88b458603
-
Filesize
47KB
MD59b8a67befc038209293e721d69138020
SHA165627bdf1e6e8be2ba77e8fd84d17a3739991481
SHA2564e419f106df79d63a3b69774e6eda1a9a651adf11c41eca7ca10844d92ff90ee
SHA51277ae0387335128f97f67bab6da28fcf249c8d7fa5a330e371bfb51352021a09cfb72834c9b976682d9ea5fc55e5ab2e8292465387990a56b805fe81f2fc86a8e
-
Filesize
55KB
MD5875abd4d43c1a48a33241624b69fe1de
SHA196d8777c8202838b04ed4378c091d359d99f6bce
SHA2562ab8351926357e6940ae8efb4af8e0e77a3682e90327bc2316755272c494f6e1
SHA512857faf5ba1cbffcc67d97cd7c995de95831b35ef7b352c963910714d22593bd9b946e9967e3ccbdefb58b2f4379f4b30500240a41753dd3cbd56595ab1910a5b
-
Filesize
129KB
MD59bed7d760825145b0e8c3065166d36c6
SHA1d5c43cbd01dd1728c447844250820e170c34835f
SHA256beb8947a280356b476ca10298d89aff2536387583fb3a3bcbed1cc9512ccb21f
SHA5120b00d78ac3e28b1d4f9ef13ba38bfaf6835869fffb2071237825925573a454b17f3eb2c4e62477ed49e2514aab99c877baaeb0e33f11c01ffb828e042208ae4c
-
Filesize
47KB
MD58e433c0592f77beb6dc527d7b90be120
SHA1d7402416753ae1bb4cbd4b10d33a0c10517838bd
SHA256f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
SHA5125e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3
-
Filesize
19KB
MD548fc54d818d7129ff53d1e7291cd19ce
SHA16d01e9d4867c2e39c8376f75905e6ad255f671a4
SHA25662a5cadadc02b1df621fe8f021493c0593e63295cfb81bd83acda088986ec9be
SHA512c30854292643b2eb6b173f4031ff0482713dcb5dce2b74145225e0839b6953c607e3312fadb7d4637b2ce587f9d1a0d406d588fe4397eb2a689e9e022d216dc9
-
Filesize
5KB
MD553bc5f4f14bff5a14d21dfe21bf5f83f
SHA1bb516ccaae6c3af36010817f1bb7a8c32a0e2048
SHA2567d835480c2eda0040edd59cab3f5f61c8e070df8000bae2f02caa8d56040732f
SHA512e9d08762d4a78c44cf106426a2765ad4319cb15bc622caaf35aa76a14974b82d9d025745991ad1ab471a3d7512e3a0738a98c1d9ce79e58a1d91e5a31601b457
-
Filesize
252B
MD5a338c375bcc6fe3b233d7c6b4f73fe37
SHA11621f7d1e1c73d5df52b7172d42cae161f080e64
SHA256feac4a689100126a97aadeda69988365b814886d3a4a8d9b721086be5bb8c02d
SHA512b5a0b9723baa5f6947fda7200ac8bfb6c3d8c87aa8f56ae612c9781a8bd6915f9ba02927f2cdadd8d82aee8c758fc36125b09eaeae8e476f20fc0deb010ed142
-
Filesize
262B
MD56112a25e325d462ddc5832a81070cdcf
SHA17bbd88fb8cf39fe007d141d45f7c17dd835a55af
SHA256fbf32783d44f720644cfe9a61dee2c7eeec440a6af977a0a1e7f26eb79ae778f
SHA5127378cf88d6abb7f567b2f4fcf8fc47a831b5d6093793127b1eb6a76f8189240075454af7eff9be2798d06a9da4f6027e5055b793901cc0e7cf0a274840fd7f43
-
Filesize
9KB
MD5574cba1fb4a27e6cc8f5cdce33f92435
SHA133c6304106e3ec1130343202c45d9137913c71f2
SHA256f8419f2e0c7bf8ce9ca38179726b05c111e7b3159e9fdd256901d1691d67cbcd
SHA51226e6e614a4fd734e5099066043394a210179a7896cfec42e080806457c61dacb20c5f37d09b5bca3dddd98ebca460f597ddcf4625fe40c27f03e840f5d5e5f57
-
Filesize
7KB
MD5f146ff6f3677fa376a4fdb4ff6fb502a
SHA114d94b6bc6a2fbee75a601984d25aa9505f4c64b
SHA256b579d65d27c57a418c2fc937dc03932a188b2300af3da3f0ef03ef06361b46bc
SHA5126f08cce49a0f1402ccdfda58784d216eea14f9fd750ac493377118453d029679eb419e1fc79d31675c74b2c192696b92a536c0b836ca89cca1ec3bf1e8a22866
-
Filesize
1KB
MD54f39463fe88203358e08a38703269467
SHA136ab28fd24d005940492c465fa96a47558fb72dc
SHA256a2822c87fdac33f82e1669e6484636ce210f9918925d7282c6c932ee12418fee
SHA51250d32599b36beaef824edd17467b7f60dc03bc0aa422c72d86ea28c3e67dd58b9217a507c80b20cd74a7af09264579066a923501eb78713356d5412140f468ed
-
Filesize
10KB
MD51d433440f873fece5acbcc1365147092
SHA1022b8e1c34da005b3cea4bb69009e7e35614022c
SHA256fa093cb7e654a78a1915b6626809314098bf36e55f581a9f092144d37122a7ba
SHA51224692d670275b23b6e3aff2cbcf187e97fb47df609d1371f02edb2b3ce9e41c45b37311f5973303d6d00c825617765ac225829dd593dd271d976b57030646c90
-
Filesize
16KB
MD587f566bb9b53917fc40185995cc5e145
SHA1d3ad718b26c7cc62f4162b12030b4887b780c4f2
SHA25646726b8ab7174ccf9e9ea53b8e0b097a03dc11639c3d52aaaf29a7f5bb1363b3
SHA5121c5b9575c1d94cc289eebe63ab427d03fcf8a11e6ce3e942d2f2039648b4c7a17fe743dccc2757231f23ada783fa8a66177b0c59611b9d7fc9d842dd493d1b01
-
Filesize
262B
MD5f2b6f694995954c6e269eb7a48a92f51
SHA1d3c53b12123cf7a99a51847dff13cab7d803885d
SHA256f5eb46f08e12456adaebb91f6984037b4edd91e9efd7e8431b166f0fc1f49283
SHA5120f4d59eb6aa7577bb4ce6c362b052f02f05369b7a737a2499790e074da1dc8b7e6b7856a337a62db4d3ab8fece1c01d0e8af644aadf7befaa4bc591a7bc4e032
-
Filesize
305B
MD5742d1334b0d835855936e5cf1aa1d5dd
SHA1c883a16bbd9ce872848ab3c0fc8d3238fecf5f25
SHA25656e948dfd3236f2d50fd4a802069fa97538657833e5ebfcfb4debbd26bc95d38
SHA512803760ec95e7a6628003823820e1e8b8595bb1040e8ce9b30b2f14873ef7e463b7e3ba2728da61ec2681c2a8c46d0dfd11f1796c21544078acffbc3bef865241
-
Filesize
330KB
MD53d6b0cb0914d5b431c83e60674ddc628
SHA1c238939a277c7162788b5953e68d7838114cc152
SHA256754b638b69da2c7bd3ad70437da86814c07cf493fe0b070bc2a8ca21922eb0e6
SHA512875f234c0abd41007f3572da46df35429ae47c9154057c3f736042467d41bdff54212705f1d82b92f762913b05037227b9afdf892fe91e7cd4644997c66ecbdd
-
Filesize
1KB
MD52e71aae1d1ffe03b204261a6008d1a4f
SHA18c6d8304d11ffb9fb85da74f88564a077538ba24
SHA256f339dcbf3ef716225b6be0e84862a4205587422afd05bf492dc9b9722ae480e8
SHA5128eef336e64224f64d25a6cb9c9fbbc3572eefcccd3731b4a12886d12ca0f1637b639772d5093ef3952d8656bda86500923864277541bc908f1d8ac759f400215
-
Filesize
1KB
MD5a5e860682fdcf0e722e683ce6768a9eb
SHA1ac696b2500e4a990c2d9b4292843607dd374c5d3
SHA2562b1791ffe4e640422edace368705182405d8dce1598eb8695161f7abcf9f3ec6
SHA512e6ac5c83355e4f65ae0473a0206fb4f6401f6584b05039333a8d328eadede6deeba3b98f87e86f06c6c2e0b5ffce0c826e97e6c6af4f93478257907c23dbee8f
-
Filesize
7KB
MD500a331ffccef392ee2efab8c8ec9a6ea
SHA1c190e1d7d1ab7e313bc47617f30e61dac8975406
SHA25613ede3ddfae4f20771e5ab1cb3919591ae84bee6f7822a7f9329d06ae475e6e9
SHA512f5237a1bbdbeec2b148eb8735e484fce39af5b7477041579e957cf6be83bd2c23164b7378dc8e7f038e53c278e9fa26ec89b4491bfe1b4693cb2b6255720d148
-
Filesize
3KB
MD5d0b20a4f140d4b1ee6eb832c3246b4a2
SHA1dd32b8dcd3a065c57fbe3a5be212346cd140186a
SHA2564a5bfa8c22ce4bc61d8590fb0a45eece534cf545d9a92bf6a6b9be418f812f65
SHA512b6aa6c2842aff8b210ae21b7d80136ce0093acd733f69af4c24ca6f0cc0d13e86523384ca87ccb4ee737273095d55ab7c400166cec6e8a6b788f9d1a0a2539ad
-
Filesize
45KB
MD58001d314becab95bc93d33dc4c221b7c
SHA1bf3861ad50e21432e004368fbc81ecc0d92a7479
SHA2561d5ea75f49c9c27985762514faa81ace993744308e271b7e21d4fe6feb6b1788
SHA5126c1c595338e228bd4d2765fce46e05e897e208c7caf0e4c919ade938360499458ebc046a2c969a72bdf3a02ed5a18c85188953b09102ed2f0c78948c58238f6d
-
Filesize
2KB
MD5d9a1b7fd49dd6a5c72d290e7ddab6db7
SHA1c809afc4344b921b6a14d264ae8c01b204923ed0
SHA256a03e2cd5181c7e378e5ebbfe8af79c121c72975b89e287cddaa74c7f74f808be
SHA5121635b791eaacb3daf6a42876f38743be34bc23879a8b0cedc50de33d365da49fe875fdae45aa663a4121333ac6f09c66c8bf42eb3cf297ca4df61ecff62ae5b0
-
Filesize
196KB
MD514322afe95e90bed0a674ec320a7f380
SHA1d9ca34ba39d0e03554c47ca6f96fdf9e5299547f
SHA256885af20f14d59297f596c4b5d19ca0eb13a2c70e6bbb4e35556083e23c383507
SHA51206ce51fc50c0bca7c1e1743c216aece6788826ee4de27c98ac1aa1a30b819c626e1f77af88a0b5d85fd5491dc08787df4a7c21d4f88ba6c749c949e73537dd71
-
Filesize
262B
MD5d33d676bfcc5e7f05ba1e3587b74c562
SHA14fe26976ac497a570af5e192f331e611872081f0
SHA256452fdceff1900b5a62ad717351aa6e9adc9026013c3bf56070f5a39901cf2ea1
SHA51253c50147ce9dd4b3c7d75519e5a51aa16cc69251fcb77c86c44d12e7add5384da594f862f10c1ef7814ab1459ef753c15b749db39634ea4cb9d5f3445cc0fe37
-
Filesize
243KB
MD5da6d5c2184c92d0eaf21c6fcf6031957
SHA1554f653f0bbf2eebe8b23a3a4ee9d836a75b86c6
SHA2563b717daf9c521fe4bf075dc713cba21e8fe2686ebcad9bf9499febfc0f2dfcfc
SHA512854b59c116ee6ae371142345ac565ae6c1306d175e189166ae643205330949ec179cffb7276a0d23139d526bdebdc21ef294a9cdd84cae7d9a2f138770cbb6ca
-
Filesize
27KB
MD53f20677cedee6e7bf4e56a86b91202ac
SHA1e0353e0596b1ea96777a57ac82080817e5ad92b9
SHA256c694df1c586f0d252e5ac9f2ecb7ddd463f0952f7c72bc6115b12f59a0e53b77
SHA512fc45870626b82b7f8bf9aa83cc117d7b51696c50bc33e9d5a4d162764a3918b419d44260102364aeb583a20bb50e58c0c28dfc7c9bf9eb5f8d260fd86048870d
-
Filesize
3KB
MD52f042100ad306bfb3ada7d9afe5b3f15
SHA1c257c470fa1c0e18bb22f03b3bdae322e21157b7
SHA256e8d4248b3c2206b626e9ff8a201f1530c479d1ea133ea826dea03c983417e76f
SHA5120eb6630495b0d1dfb308934513cc459b8d7b29cb86dbfba1af7a0fb2ffab882a2dc3d4d646ca94fc2a779fde1fbfa7d95f1fa4b0b9dc63dd7f610743c19830b6
-
Filesize
17KB
MD58db135da3434779d3e2b967a484e8271
SHA1cb30196ef39c3ae25defb11b770adc5aa27a8868
SHA25669af792c8870f6f788024c1e741c99e6efef8fbe196f53b1886f50f3b6f5c297
SHA5126dd10bcbc9ac9b6a8ceb7c07dd2bf7d4351486253287b61ea62518edd4acca4d5e4907460c16dd94492dfb58d9e5178e79b50472a79af98fe19461a4c39d6535
-
Filesize
2KB
MD5e73e64999e3cdda938ecfb3fca953fe8
SHA1a1f0629d051c692e2a685fee8288fd7b62782598
SHA2561ee35ecb1f77e84ae21531a1c89de3393d13fd7a00c89dc95637edc756b57ad7
SHA5122aafffdabc16ad7b3ce4c33a99f084912512bb1d4c388006b49a94fe426da82e5ff7f3316864925a615c4e107f38b415d52605757df99917c4bc0b29a8e0c9bd
-
Filesize
12KB
MD547979db9fce1b0548b7bdef05695721f
SHA186de7bebb411d494cd243e1d946c4e2ac550bee2
SHA2566dd7a1d7b088ce21815757ae7f8870781c1dd100e0dd7d86d6af4366b507513e
SHA51227f1b272cdd90a753f0c5a39dd65aa4448120ad4634e4edcf624df6f621378e513276824978e102a290edd47a7037dd4ca93dec7d8b47d7bb754d1ba253fc76f
-
Filesize
55KB
MD5c60206dd5d8c44b1e0150dc80c72388b
SHA12b185f634683baba863cc53eaa1e4f287478efc6
SHA256db0eea57bf0dd6ad73961db7d2fc3edb99ec7f3b792b10967571c68c641ac55e
SHA5122adfb0920e929d89de25ae579611cad2acdd13aaa4314a1fa8a63b2f2193ae7e789433701e40af83cf37f256861f5864cc24ee2c2933bf6abd7ec9bad6fae70e
-
Filesize
9KB
MD53f0156a7dfa07a97c2d77aae7161e746
SHA1ba10892e2084e517937ea0919e0fedf707e0c0d3
SHA256857434764c9f3e1d0e12f20e9ad9a1a0d05f8d73c0f3dbd71cd9f94ff627ab9e
SHA512b8a05da2b2c514e4c1b03dee5d1ad2d8cfdc157bc229c75ccb44d13cfeeb6796158ab8e0ba730051340b0854f7313a62802ba4710d0cde7939c557abb187a354
-
Filesize
54KB
MD5db4bdcfe4ee6364fc25dc66d3717f6c6
SHA15340261f8e13b1cc730271b26438fd15c8c59121
SHA256515d8d1462ffdd5ad01737ba1fd021324dd8432eb7a9412ff536ab27250a66cd
SHA512eb6b015e756bfcc4fd4557ef7ebab51313e18c51ac6aa376272e61f7c947de151131dc0cd6757e2f8d1cd0561bad70a32dad94497c5c75cdf3696d6b8f371674
-
Filesize
1KB
MD5d713613bbf1d1eae81c06e427f57878f
SHA1db97aa24cb7d0a0d4910c7e2a9d80a9c60580773
SHA256abb031caca82263562d56ffa60ee15400b40b6ad4d9685345be4f2228db15a83
SHA5121c104b1aad1aa107f319ee43df1457cf99ca2f44721091e2a073146f5602f700cfc73c915a50c0edf2f47c9309afb6dc71316922e5bd230bb33790270abe2992
-
Filesize
262B
MD56882a2ec05084bb33a47b8279ef3c2de
SHA1484d85c885dc51b93151d720ce1462a71c380c61
SHA2568d7735181a7451f66a3fb4e20f44d5c3f751c7f84b0625f51dc80d436d7da51b
SHA5122c9ad0f771228fc255a380a6552e2120bd36bfb1602de97df071436231e3a1de70017ba86dff4528a5eb8ce251a414ed9a581186602bce79b50c4d4a50aa5608
-
Filesize
3KB
MD56fc1cc29803b90cf988a49d7f8958820
SHA122f1a148265bf629a4b596bea00a6dfe99026c3a
SHA256e189690a3cab9da3bed3e43f3e707b0597fb4874531ece1c97eac167085364ab
SHA512f574cc32109e930a78afed666eaa70743d533566783f83291304d25ba6c6c4f62fb6b6a77d15a8606f16bda08e21cd21171cda5b3a4d5b2b84912ea94ddb7b08
-
Filesize
41KB
MD521de5bec52d887632d3a3a81cc98997e
SHA1fce4e84375b4c71499f8b7605afb3ec78081ac84
SHA256221666847d8cb46c342a91d26855e6d125b2a27fd0f30c3a48e709817be511bb
SHA512aba015dddf744fd6ff4390a1162de8eca62f9d08f1ec211064c7cff8de6f944cf76dae39c589599f1244510982149ff07c0fd82537550690ed7a94ce357404f7
-
Filesize
2KB
MD5f3e7b6c6bda97d7c1ac816b3330fe00c
SHA1177451dc7c3056a2dea69be312286b32fd1ba57d
SHA256f74458dfd8de48a54442ac043c1ca30a335a88d6d15521ec0e009a4ac67c75e8
SHA51253a650a2692ef8de859ec6a045309aef845b7e0cf4f6643ff2d0b879cf30787dace7c0d5e161eb2873390ea829766f36f0ecc3c0d2275781deb1bdabf718ce06
-
Filesize
3KB
MD5ff19bb39fc671b9df59dfd2f48abc098
SHA1c0534a7dc4d6fd70fb453095a7a34f7ca2c9a638
SHA25669b7d7fbba8ce2714a10de54b6f80ab264195445f9b85e6b10886dfb2cf4777c
SHA512745090fcf782411a71e6b3659578716789ede5fe61ac0c2cfb38c48e89bb156e304eb07fe77fe9f758730046986a7df43811a5ddce1fb619a8635edf3bc26ca9
-
Filesize
3KB
MD57347670898f09e10a8525c1f35f8e443
SHA14330b6dc5a2892bbea840c5dbf02ec817fc06a65
SHA25616fba8053f6a294b25e8b77e6e6e1fcf60f9400adeeceab83783d1c95e05d0cd
SHA5129029d835ce2a8eb78cd99012e980c579ea38ad4ac0d8e38c3a1b67740b2855f83debd502b1423f4416d2a3bf8d25fa5246492f7d917d41ae445139c6cedb438e
-
Filesize
2KB
MD54afd04635181502f72931685669db7af
SHA16172fd94f61769d3a48c2ed4362df72725cd94e2
SHA256594818ffae6bf01e80156908e3243422f9fa9d27afd687d022f0ded820a3b68d
SHA512008496fe90c880a19ed2f8012268173dd1cccbaaca33e4cedca1dba6423b942e014b5f96d72fded289eb59f710d7a3ae41a302dd64765c849678d7023027b176
-
Filesize
3KB
MD5128d8a08ab853c5e30906d114edc0b29
SHA137ffc647dcd027c3ba5863114373bfea34e39c4e
SHA25628fd070c9c7dace05e7d3e21b66844c46bc5ad276487f2978835bc0a7f87954b
SHA5127b7f43062770c8948c72671759627950aa13081e7765cc4d6ce6405a2b8dc5c59de945b59046bfadef84256bc86f1f5dd39ec2c67eed1ac294c000556522a28e
-
Filesize
262B
MD59bda17a23cede42632e92053b4bcc521
SHA1a78eda3ddb9e66cfadaa676293cff47049a4feee
SHA256417f1e271cf908059b3b9481003d1edd15569128778b7e2a671681da94b239b8
SHA512a134f61b1745571d4381f6517946a1d0a135893f26593632432aec1ab8a4da911cd23c4c305c265402d87eca2ca34df92bcf5b2d21fc9d7d337386de9be24a73
-
Filesize
6KB
MD509e3b19b064ddf41c2b1303a86c9d84e
SHA1e668dbb55dd76c43946268a4060a4b8363242df5
SHA2563aab79b7a86c24cacd8a3e95917bdf75483106c6e0134b99f0e07120a7dd0a2c
SHA5124be37c2ac5b08bf9505224738824c940f7555193533c20cc0331d0ddd329b7d48af487fbaeeb9b984e02d1a8df52c1d0e4f10277ba36161b2314df4b5c709344
-
Filesize
2KB
MD58fdf649216db7362b5a808433e8ddeee
SHA1f862bbc4b8fc7af503081176545cc19350884519
SHA25679c1b95ea9143f4d477ad4df49bfffffd1840c6bb4bd54253e8f173c06b4b4b6
SHA512699638bb56cb405cf03c0dae387f4ef26a5cc80403af48af4c2eeeadb350560ac4dd50038fb9e06f4a75884db7580eedaf7b33707b18be58c90354a39bdf51c4
-
Filesize
269B
MD563c480275b3219d03749b15aaec41cd3
SHA1ddfa64d283f77e00e5b35b7f6322b82683380895
SHA2569ee0ed2d7fec0ecc3e458c3c48e845f84f30afd7a876c303be179c1c52e593b9
SHA512e66b4644a42a09b94b7bcd9f46d38b46b8975ffc5f4d26b6f02cfcd4fb9b44c4374101ed003b1203ac9c67ec33273cb8d77523b1dda403c9621c5c26f4a0c42b
-
Filesize
42KB
MD599ddd2b7bae598e438787630f4651951
SHA16ed09f60a28a1d11575f58732db4671181eec06e
SHA256ce6bb5099a96c82fb47ee19a8e3ffc265041c2de3a8604313dd3bab666be7a03
SHA512b867c7ecd27481085a9022f4d0c2a724bdf7a3f6826630a21557caaf72fe7aa50881636dfd05564b69ab64a9a0d527b13abf6efc77dd263e7a346bba913464e4
-
Filesize
262B
MD55c3480e69a1e25fa08790609359642f1
SHA101ed271f26f25cab1b358618bcc800fc2340d430
SHA256d154055179f8f80bf188923f47407bc8567d39d004238cdd26788c696523f8b2
SHA512060a43320eb61f2f530897eeb3a1525286ef62abb9c06c1c6ccca68eb0dc423cda0226cd749139f142ab71bcab1ff06aa1bf16e544cd4d14eae64d34fbe8bcbe
-
Filesize
21KB
MD58fd3d64f39498f6e4edc27c7bf23e73b
SHA15dbb106743621337252baa2ead0a4925316449d3
SHA25628bdc3d1c1b1c400d30a8d87fd2b0cf6db4658d8c08349d9ef7cd7a9f9a4a01b
SHA51260a3f37cc94f9124f20c8a3905577177dfeb153dbe3906e0d8cea1125cf35e991182b877d0c44cb63f3a5a58fa1a3853ea0d1bdff2254b1a01f023baf6c761ee
-
Filesize
262B
MD5d1ea7279284b307c92ce004b822d7a7c
SHA13eee4e410b09da8519ab4868378d05fdde032289
SHA256522411d3bbeb769e4f65f5a50076adfe47f76cdcdb61e09462c17b5062d9dfc5
SHA512f3e5b469fa4911eaa306d557b7fe0ac4ccb4f2118a8a61d618edce87148bc4ea9246fe0b3546277b68a952fb39c0a76b255e7cd415827448485ccbe217f81246
-
Filesize
2KB
MD53411180e812c570fcc1bcc517537f9a9
SHA1a2b3b4777012539e696ceeff0a8c710de79748bd
SHA256b811854b2f1c001a1d31209939e0199970bb7d7d2c08e963a5199487fe5a12ee
SHA5129de5e9ce5ea6fca09739868326798157e15ea3775c591a9792afb5b20f4a9377e8395d439674b2bf303d19416d6036c8a2c5eb26d0fbe0f96bacef1980ad3482
-
Filesize
2KB
MD515d18f82c7b6acb629568347012dadf4
SHA14ae95263b73151f916978c4752631cc304ac6496
SHA2566b5c215fcff6e683999297edf3acd8717295053e68dac5a9e0be8f296c963b09
SHA5121ca0ebe1b876d0024669536f8a1546caf85445e848313cca0b84d2d97eb132c2e5cf17d1419d0d843927a9e1427b42e4984f805579d50afdd3ef1c9c5cbbea78
-
Filesize
2KB
MD51f8a2ce884dd8d7d6f25c867a2c53090
SHA13757d2b0841c4007c14dde26c05d3520582e7aba
SHA256a5210034f27d09e0cc03e1c65275c4fcad90f238dc6813864f01e73d891a395f
SHA5122f2ac8caa76c04aeef4908caf23fa0d1e80fc14c318d2bd34022dd30a8e7f80e999a625cd58dfef1bab6ff5042354933ae773dd609ca5f70f77f5b0b58346223
-
Filesize
262B
MD5e7abcffda32003a675efaa870068f236
SHA1400fe5b4195cd4c7c97ced56d823b0e692df4263
SHA2564910182270eb73976a0176dc2a90f860191d6ddb338ea0a270d2e59af6a68cab
SHA51266df33b77657cae366da54384cf6a0fe2afde28ed4a7b98eef0eb5cd5b9518449fb320bdc53a8f22269b9ba6ef60fba7c7348251ed1b52e27ef6502e0ebaa300
-
Filesize
18KB
MD5314ceb54eab38be477096da2581ec5fd
SHA1e8f79d9cec52372cf86481bd097823bab6ddb3d8
SHA25620f96ec36f4947f1fab5bf4502eacecb27512438225dfa602225d53a5bbd4365
SHA5127e47fe13d4d8031bf47af58a4c887661d38d7334f1a16f0afeb71761dfd300d636331758a9375118904754656a131b42624ee79818f036157618a60927fb3e40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize16KB
MD5dc61e696b0b4a6d2a387333b81ec1332
SHA16fb5b7112d9acc6f53550344309b484a3ab7c301
SHA256f7b2bff2ae3d348effc95e89459522c9ff1a1737787dc9fa1a0bdbc3f20e40bf
SHA512732c5a1012afc7564a4fedbd1025d4739bcc6b5c05c9a426fb6a576df361ab18812657cf0411e7e3de92affb28a8eccd491a1adb672244886b2938b6d5c45bf0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize10KB
MD5ed650a45d772519ee94ba8830b526071
SHA15673dce50ab5de4cc2e839ec78da9eb818b74596
SHA2569f6977e6297372400f6ab91d21c697947fbaa7343271319e1f30bd62f5c45f5f
SHA512c77070be5cfee16973d457f802030d9bb21b065bc7054166cd613015d307d0808363674b0afdf86034dcf56bc3377f7848924e93c901f8e3311a49f3671c743b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5ee7f700594b7d315d2143c0e65aa9352
SHA17cd1497942574266d576020c0039516a3fb53435
SHA2560bc68c0908e2ed8be5ae250040b30ac6c1a01d946d21676ab288cfa5366b9ca9
SHA512a6128c319a9164277d2101408d5644740a4705cfa67f7760e73e9e75f9cc8dc31575aacda88735514cbcb33e9bc4a4cef9a735ab440e7698168d7e456b5591bb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize13KB
MD5d257f0913681eb34a23fbe3eb67ce6d8
SHA1c9232a7277151b3643bd50c2cabc1fb33b223b5c
SHA256b03202906cb7cba2e21c6c15e88534007d4ee1be23026fafd0a253a826d26fbd
SHA512606017882b687c4cbf58cbaa0eb047127b2f14d004ffddbd79501a30adfc96ce85f8eda0c991e5d9059c1d31b61f7438d28abc40190da7dc75c98edee01ee174
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize17KB
MD586878e06d9276d38e58a756c929d894c
SHA19cc18245cde03b4966adab7052ee2718371d16de
SHA256ccb50754df0a5a486a689eb1bfef97d73bea1dd1a0d4402035d9b53f22f8427e
SHA512e2e437e43ef318811c538dac5009396531661e1cec04c5d19d7a6ecc101c80e39b6b7b4d75864c6682ac239822a2a12550e49f3521fb7f1f23aa9b54876be3a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize15KB
MD58e073678df72853a53b2f5f2ca495556
SHA1a30138a18c3fd5df08a0b79747c31935882ded1f
SHA256bc8037b4a42a6d9dd4e0e2307d5290e9d0ea670a5ce3c840822b2102e3635d79
SHA51200ecef366ec59fff05cfb6adfe374b453e0e89e773d408d06e7085e77a7c0a5170fb4c83cf29a261a2b0122096569f926365f50ed603dfe6124fbaa62b6f116c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize15KB
MD56aabac24d0208c4940d02670a491b41c
SHA1fcac9d978629685431efaafbe9abdcdb87a6f6f6
SHA2562f4fa5b74221c54cb36ee7bfb6d7576021a4aa0832f0a8b3d00f9706b18de7d5
SHA512240a005031d67598f3d6fae7cddbb69cc85afd2849f681d4faab59c7b1299e81210380c63a8ff1c4442f98d97da72dd4e13a9a34c87b2a3645d0ac05dd830f62
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586cee.TMP
Filesize3KB
MD58cf92f00a3307e28fbcc021bc11ce7f9
SHA197f4c6b0dd5f328d372d4875ed275ea241703d5d
SHA256983467db9f4e44b81b4a963954e35c041cbdd0ff160814d9df9bcf2158e4a6f7
SHA512ab8641d48b04a766b597fac4d0e019e9c0d9eb92742b27be583d8a76f707efdc8651463aea478affc393589bb8cde5e9dfe8b4130a1ec466677fecce1075ab38
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Filesize347B
MD5e21aaf301b4a9d98f7c5f88c36de90ee
SHA11bd880d971c09c02a118a7fc6ea2e51a96c55b34
SHA25662a7a2a59fedd0937a884c7dc03063bdb59b95670ac63266b4e5a989e7667cf4
SHA512ea3f83824e875e8a08d43315b23491e79c702e4d9d696370756e081033efddc6706a92fc15de12b76238c8b585d6d14cae58563c0c94f96744a07bcf941bb646
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Filesize350B
MD54dadfbbcfa863ce4fdbb34127a79b18d
SHA1dbd0b45d5425a01b57367bf6e2314ddff32f4e19
SHA25646b9e7ef378f3203cd7642d669768afaa3a9adcfa2a91da9b32fba7682ae012c
SHA512e32b73f8b983776effa34cb86ae024e73d6ea03f7e881eaed19aed2a1b8273d2c6055629df31f9a7024e6b36860c4db1f42b2026ef8c295c81c4ce353cc15f63
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
107KB
MD52b66d93c82a06797cdfd9df96a09e74a
SHA15f7eb526ee8a0c519b5d86c845fea8afd15b0c28
SHA256d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954
SHA51295e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Filesize34KB
MD5b8e8aa5d20b168c162d325ae9356fdd0
SHA1722d6c2b6b86f93a87e822165c4c7fa9a683c8a5
SHA256125e6ca3f9c01a54c8af032aed6f8b2ec1f435024ccf67e4abbac2a40b86c62d
SHA51291299b9c8b77bc8e39b31eee8f052fc4ea495ab190b956bf516837d4a4a05015b313c247b536539d8da915bd393b4473c88769c99dabfbeb205b9aeb0017d023
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Filesize343B
MD506a5774e3d3c7ad9b57d70a1047aa386
SHA15d88d475f3a486fb7983cdcb5b7deaf0897a347c
SHA256e11ebdcd606b25064668827f0f251df6359f552774dc66f4c83d49f612083e25
SHA512fe724cbc3513aa978ed21602411ca84a554f04a2cea989fd820ef05058c57087d0b77050d01cc7d3605b7527b37e71462ba31e74744979ee6e739de7d0fb4f74
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.blob\1\00\2
Filesize1.2MB
MD53da997095f9a9c0a0bbf1f5bd983489d
SHA1402fb242436f4406c919dd9efb821305db0d2cbe
SHA256f8fb1ff92260682110fe3cd3042f2e8b383534aeadfb5bcea2f98a75d429f742
SHA5129d804cce6fd21b2e57fd6ab211f388bdadf6384d1c5f09860c3d132de5fe15c2f035b69dc87823bd3dd3d681d78150f23d4a01a4c629e30f1a5dac37d08688f3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\000003.log
Filesize2.0MB
MD5a57e2f701fc9802006fb04d1a802e6f8
SHA10283e2d4bd297e28c2e8a8fc5f7a22c7308d70de
SHA25639553bdb50cfc436212e525ac79b031c94d0ab0fd589830cead4fbf9c9679fbf
SHA512f5794202658e4883f01eee839b5311d1b486df303ca656020023b20161825c6f2970b6f804b6a048d0e42f2657b4a5dc35f5e83a3f19f8a93e4caadbcd4223ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\LOG
Filesize353B
MD5db46026ded934cf71bc5ae805b37801d
SHA139a91fa4ae90842e0a56c7d2d6a42fea0458e997
SHA2569c7b1332c18793d8c333950b523fe2e6333480f64a0017178707881915e6737e
SHA5122bc8bdb2d9d06657325383e9939f7faabfae2d566b8c52b1d4dbd0535a2048a5b213ba6869c4708b91ec4c197ae1f648e3966d9ae06d403b344c93d0d62c2dea
-
Filesize
69KB
MD56085ee577c85ca783faafdbe07e0d6d0
SHA1efcde25818c99816404540e78c6010f4268e8a5f
SHA256713bcbfd7ba7386bc4a8a55e806a27814d7593c424cbb44490bfe3d7952dfe3c
SHA5122c4ab1e2a1a584b66a5c75b27f5271908d19be0ef8d9f884ebcb8f0986d140c00c69de349725291bc7336ab2376bc8fde40694a6a689af304907678469e1f50e
-
Filesize
65KB
MD5d5a3e1139478b31fd57130eb067d07da
SHA106696295eeabd5fa5efbdabef719500ea6999063
SHA256a9ae6dea7c7854053a6bb92f1ce6a97a9b522ee0cb325e1d49e40a267c36192c
SHA5127c548d3bc3d907659b99e362a3b4bf9804a8e46dafc9e834032ebc2cfa5883c62ad1ae16583434bdec4a6572d8268cd3e8a1c7020d22582c8ccf380a76091e31
-
Filesize
7KB
MD5d284619c9661e5fa5c14933a96aed212
SHA19a4bce223ab2a4c6c62c59343e47c4b56bef2fdd
SHA256e9b32f939fa33e4fcc45a6e9eeea9ef81f6148f67263b78a9f86ed7e619b0fe8
SHA51282d5e25e9c187fa8337ab2fbf5fad09f68268c46aecd79c6b939579895fb3c1ee10a0dac6b4a2edd0cb08ea1f069c4df4a96db03d82d7145e353a774af8839ca
-
Filesize
8KB
MD5405c88ca03ead46db369e78b6cab133a
SHA12a4f90207bdf6984002c3d8a446d66911c12292d
SHA25621c71b88fdcf5befdbab8b10dcd08ae4e40eaf005290ef5faeaedb183cc9c898
SHA512719afd5cbac324d02be59a4f09b27bd848c6aa379c7f4124f45a478bc1d5c24f3ad3c63ccdf4b852a724243a0516d43e75951f6c4f136f530598684c00a2a4ec
-
Filesize
24KB
MD5592c3886d0170ae43f2368c7cf877fb7
SHA1929606749a2864cbd5578c2115987044918749ab
SHA256a6f36b91fc894fe89f2a3d637a9da46276710dbe1508e3f3452a8b056a894899
SHA51247e1af602ed498ae84fc9d296ae2c3f3a80b77716c4dd58535caebc987f1213f9be7d51e381c28dfbf6f19a80d130fbe7e79d3f00a8399dabaa3d1ea25d59931
-
Filesize
50KB
MD540978ee0e10e12fd6872df984dd18aa0
SHA1e49fa0a1782b63e101bb240cbd07ec630ac228cc
SHA2562fd77ad8f7e93d5acbed8e52dcb338234b7e8388f8bfb335c8a1a39e440ed38e
SHA51233bc661849b7a53348ee4a06880029bffcda1be2186324b52af89018e5d8c204958a7af3a9d40b533ea44ce914f969df39884aa6332d3bc5b9367a64470f2050
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
211B
MD5dc6c14b128cf9553c25a23833e1d45d7
SHA1d7d7dd84bdf1027c115739d2691a521fe2e92ae1
SHA256c1c85fc4c0dd29fc3ca32005da625f4665de6fe4ad688df7d9146a446a616260
SHA512c6c1c209d5f6f14abdb93ee21975bca87f167d3cf6a4dc295fb42a48a8eb786f15f10bdf4027ec2a90e8fabdca8a8845c3f72ee0c05c254d42e5274bb728899e
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
211B
MD5eb581cae609818f446b6d8de4b33ccc0
SHA1eaa1e8b0e414c2797471a9fe8088490bd0009d7e
SHA2562a323161a467ee280673f3ce39338c0699928f6eb46a92564684c76bedab6791
SHA512a12f58b0f1280cee7d70695c33c1e184fd54591bf34838c959f64f0adb929704806240f4e56d9f19e8dc655b624b562382a70c99a76fdf0c6f77056e4fb13785
-
Filesize
211B
MD54ef1b9f5bd395e80b5e4a9bb25db55d5
SHA1826942ae9059f70c49768a5f42e40747c04b3d73
SHA2564f3f41721aa93ca5edc1d9152de7e7f91b78c7115be3a0597891ed16111a26a2
SHA512e80ee27c0b59b31ad03b9be4555b934fe557b8e0a0687b459c983c813a06cfa8adb658c4dca31900aa1ec6b6db2fea91f4a80a0268d2b730f6bf8264a0ddfe34
-
Filesize
211B
MD5710247ab26b6a874b4bda2c1f725b819
SHA12b9954bc84af0c02549a9c0d702298b48bc307ea
SHA2560a10bdfe2c95cd885e22fe6cc74b20541cfc74598d8f3150b9a5cebad17583cc
SHA5120a6cbc9b585a03687cfb18b494755d49530e290b31b1e327ec7b660041f39c69c3a796368ed99ba00cbeceab0d4e9e0f103206d951b6959921fb0e6143758766
-
Filesize
211B
MD5b5b98949d539a3e3b4a05879f8b32c9c
SHA1c8361153e95908d10cfeb9a58102b188cb18de46
SHA256581c5ee81e06b7247a10511b9d1d6c8de6ae8188a9a5495321a1665b48d704d4
SHA51215a8c928d9a51c98799acb99d5f1cb6f483c66aef14f58477682593de0b43f7b21a5641edce8a0b9121e3658611e954275fbda51277362114f8bb267447da77b
-
Filesize
211B
MD5c05eaf8ad04e43f93b09b6859da0aa0b
SHA1583abc0314ed381804cf90c02592629f32ac93c6
SHA256b0831f419dc16ac573b3c749e43ee5549415ec876340d4960c6ff6251b50922d
SHA512758beb4f225d4b0051ee556f5793a4cb4df6346151165a6327232f76495eb3c55c8edb25ffce16b4ebf1335c33b803976762ddbebce22fff6b992b722873327c
-
Filesize
17KB
MD556768668b7b5472bcbd890ee43993611
SHA13f3e769561618c9fbfb628c0a1e0aa0b4ad469f1
SHA256871a2e571cb3c28fbf4b0abf95f2f2519ca32a4438509ace71fd256009cbfb91
SHA51291a130ce05055af9cf189b51cb6cf4ca00b05c88cdb9f6946e1f98769eddb9487ca5481b1ae2e4f1611aaee70cf9a6b17ef23006f5bec787083f39fb2504352d
-
Filesize
19KB
MD595fd0cae0b7537ea4b422109737a1a07
SHA13e73ef9ca70d36df4d0fee6fcfcc1a20fd02c504
SHA2562489c985bbc8da19e8a20eb9e0395c56ed3cab8049df33e06845e98109394150
SHA512cb56d070d24adba0dab57ab8683a58f8700da5ea3b35526f806b08a0b22c9d9d952897d47ca05c18efed3f38dea0688be8bfc75151a6adbb0cf54e4a65127b09
-
Filesize
20KB
MD521f1262ceb41830d10b9447fa9fbfbc2
SHA14d7e4b3141ea03836221441a31c6479ed5835082
SHA2566fa0b61a755d2d75c2c1200266044216f6137ffd49a82251882ae0866241e602
SHA512fded78543320820a153400d4014285bb96951a926f0b44eb7924f75b9c0cad075f359e99b925605097529d144641624f4454d1895070653197ed5728387234db
-
Filesize
17KB
MD5c7a717858546d2883c81000881578653
SHA1032c2b80d2eaf4ed815d109f5c13b44b2e71ec01
SHA25651b8f5e8151c911b2c66e46040ea64edd4a8420c7e18c94f4f7e3923059a4346
SHA512bd7d2d8f8314cc3dff37b8349e0b3ee56f11248ab3e2e5882139aaae373cfbd8336e340b0f7a22e09d1f04d365d552f07bf8bc0ec93626aff9887c9c8519e45d
-
Filesize
37KB
MD5f753f8eb3706130baf8ab24c3d4cde6d
SHA180815dabdaeaa6487596f846c3d766125cf67cbe
SHA256155fbc73e70c10d2149310667aad2192eb57d7ac53026867bcad86dffd30bc21
SHA512d3a604ce57a9431c142373cc76d059f09ca54ddeebb821e5957972ad900473ed12c4587095b94355c36d7a7e2270bd2822a14e1a3e4f8a3643ff3ec2d491ca61
-
Filesize
38KB
MD5b3570d0fc151a9fa5434f9aea6b44f19
SHA14c73e1b03694e8c052b0a1f96d5c55af372f3f1d
SHA25661b60f4d1fa1ad2f5d6d0ce444be3713f02b7bb49c93829f6fe1d38c7e831656
SHA51228545aeea01fec51818583273aa9b941775e1f082e09c2b69314eed93d1b98e9077d40e445f3eed55b6c4e6a03f27ea07ea715707afab07f864381148a609b17
-
Filesize
38KB
MD5ede3ca7130bc5dc19e3eb80f9e90ca2e
SHA106e0f2707fe1863b6ceda2bea18104b70c06bdd1
SHA256cfcc17f8c8285a6566806362736e99b2ba81650d6875883f414f97ad992fbe1f
SHA512b33df49a6bf91dc29be35c659c3d65c491bf2e4d12f90e2a2b9438b027d9e56d284c8335a1766c91054685bd29bcc08dadfbfd57af80eda9f8f3c487c8cd1701
-
Filesize
23KB
MD59b961e825ee5ca79a2e5e2b414cf70ca
SHA1dbb755dc60255410c8d5f9cd0690f6802cd7f09d
SHA256b8e47de2336d30158f6bda99d1c6b04bd72e9c76ad8fb1fb516373012ee00e2a
SHA5121f0ead32911971e9b151c3fc2bb2769bbece0976d9dd112bd8aeed21eda39235233d353585658f84238326bbc8c32d392b871f3859b7d6451e4bd960c24dbf74
-
Filesize
36KB
MD50ffa6c5cb3988d2c8423443886ce1962
SHA1cabb542d256e4ad6899024b96135419635ddf1e8
SHA256651150750957b34db8a8b3f122c6bc593d3cf9dcef7edfab6d95758434c2508e
SHA51252dab514904d526529e7476707ec6c5dcea4d1faa8ff549394fe5f7c0639d1970f30cb4d38884b39ee7f6aad7589e08bb27694eea3468689c50433695fff7536
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3255e0b7-fc87-46d2-ab65-757a6da4561c\ee91b116cc2005be_0
Filesize61KB
MD5235aee1f8b4d2363e7b5955afd0ce928
SHA1f2246d1873e9128216fce49ef68a752ed6ea5d2e
SHA256940dd3a96f4b9805f2f67ad00f08f83fdac56796ce9c088a01fcf4a28c69c0f7
SHA51276e2db9efc3eb38f86d2fdf55b198c7eda7a16fd48e92dfee3985192846adee7ca7cd8ffb14b85a52d9d204388126f1e1fe514b3e6a5196453f68676bd7f29d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3255e0b7-fc87-46d2-ab65-757a6da4561c\index-dir\the-real-index
Filesize72B
MD5027a942de7489b47a4f0d5a269029731
SHA10249109281aab202312483ea9b469f8275433733
SHA256607aa1ebc63b50d0519511b97c559cfc68640ea09b509fe343f223004cfe6487
SHA512bd511f10b7322162c3870b4cd23e17d03605e9d3c8163930f646cfc0c50bbf2abf56a8398df1541c259fe86bf6febd3401ffe703d56c37e8d8f44818b0fb3454
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3255e0b7-fc87-46d2-ab65-757a6da4561c\index-dir\the-real-index
Filesize72B
MD5fa18beafc3309df0ede7d51134b88ed4
SHA172bb2b602b85cd79a5dd06693449c1b339508dca
SHA2561655eac8e6fe6ec89f4e1a84d5b1216d6ee409361349bc35e6836bfcdab2b1ab
SHA512e6f4f3f078ad6e2d8779a3ed9e3cb92b87306023af4a64f05194e8b49cb97b0b34101820b8794e14a4763f756e7dfbeb15f821eee2fec7a2a22fd495817817b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3255e0b7-fc87-46d2-ab65-757a6da4561c\index-dir\the-real-index
Filesize72B
MD524c7b572c5fa2a3f47ff05b75c0e1a72
SHA133f2f9b1346b27bac51f7b17f91a05b1b82e8688
SHA2562925b6d90b958f541b9ecf5d02527fadb56e648ba2e1e6d309f58fff1ca6b4c3
SHA51245b27fcdf69f722bf2df3099e149586cd9316214a16706162fa23724bf671ed0b129e9bdb880e9ea81ed69dce715d5cdead9b0662d077227d9d4fea7683f49e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d77db88-2032-4ca2-b220-700a886127ff\index-dir\the-real-index
Filesize72B
MD58830052ea99bf85de2b5f831bd86cc56
SHA1c351eaf9171c3e2f50e15dc2755e2ba909e3f869
SHA2560670e5a54679100668544e0483e59b4ef6dc96f7f6e3e2619fd20c72a63293a4
SHA5125db3f012dc2c38e96c9e9756c882980d748518698112c4224f9eef60e7838c105ffec74a5bdca5baf66608ddf963db4168088ede9355956b276176d99fdee348
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d77db88-2032-4ca2-b220-700a886127ff\index-dir\the-real-index
Filesize72B
MD5754f239390e3204a2259275ee6c35b1a
SHA1ac402e191a1e49f8bf7e2194f8d184ee2aabe581
SHA2567bc5564aea7155d65c4b7f50f9e75fb7d141bb2dd1f0e69f70f35b3aecec7e23
SHA512b4c3b544d24e8a969811e2d2d17aa51f579fe0f8b6e2621efac784941fbe4e04d284218038e6fd46accaa207526dc210178f2f7298cf1529a5a5ff42f05bea21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d77db88-2032-4ca2-b220-700a886127ff\index-dir\the-real-index~RFe585be6.TMP
Filesize48B
MD5dde32009229cabecbffd46e216bff8cc
SHA1137a6d394f9a41683acebfae86ca76b8be2a13de
SHA256f04694af930e0f5e80c3e37f92d25aca9896a723d0d8773851cbfe7d0a92fa64
SHA5128b62358d0e5a24cab031fb708515f6d476bd4e99cedd788355917a5b7460fdd7aa404099edc15e6a0b2f6ce8d94036831ceebf72fb12656fe19a9106eaecd12b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bea1764-b070-4aad-8261-2a922c58cde7\index-dir\the-real-index
Filesize2KB
MD551b29614193f46e8ca3e0c26aa348469
SHA1c7ca2999247bfa8b5dd04c0b05a95f6885c1e99f
SHA2566933b27315557a6297f48b941b0e03465be43d31923cb6fd609b19dd805836db
SHA512f1f139848fc1ab0db22f63013f1e08ee011c825e0aca726c40d03597c4b0c520f01159981331898ee5bcb4cd9cbf8c89a62231eaee111b0aa44ec8e81e7241b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bea1764-b070-4aad-8261-2a922c58cde7\index-dir\the-real-index
Filesize1KB
MD5a4f8b643121e730a08476f15177b28d5
SHA11a285ede216b6be65de021d0233c92f107537c1b
SHA2568811845c337d41ae7bae9db244f7a68476e6bab39cf05c2208f3d18e75307a7d
SHA512a6c46a9722a4d1a5c7d1c87ae0a62b537da616bbbdd8b9f23ed1a6775f431c7d08e398add1954e926ec8e8d832849739f916b5a5485387be6064b3cab28a28e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bea1764-b070-4aad-8261-2a922c58cde7\index-dir\the-real-index~RFe5792f9.TMP
Filesize1KB
MD560cf69fc11b99aa1837f3f3233d50539
SHA192f783f664cf895e5686f1e243ff5344438a02ed
SHA256840cb48f7e5b32d1e0c9fc31e0ef596878840a0d4268a8cbb601d7b74aa2273d
SHA512c3a9e9091f62a3f951c8fe1ec6405f2e33eebd67763a98f2427f9e28de1f8fdeaf8ecb62becd2a88d0f1aac144dc9a25afbe5ac600683aaa6366246c3b0788a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd6ef991-53b1-404b-b4c7-b75150927eed\170ce29fd1bcbf73_0
Filesize61KB
MD57d25e9022df5be7e8a4c1d3d1501900e
SHA1776723cc75138c17ebec7ac745afb43491af74df
SHA256d1f28874942e352fa21be87e4e26363208c8a0c39708ad6ee1f78f19f3a2b750
SHA5120467fd192cbc989558d949498b5ba52fc4f84a339e1327808cdc5e676e26aece2b7438e2543c496432e168866c4c69002a22a8b200ecde522a6f761cb39ba6fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd6ef991-53b1-404b-b4c7-b75150927eed\index-dir\the-real-index
Filesize72B
MD5fd3f79fd3309a05e115e8ef88dd1e7af
SHA1c38cb5a9827b9d8c889b927799c067510a25fcf8
SHA2569915745c0597dd346b707097b1e926fdf3d7156a98901f85a0e6060d63cbf1f8
SHA51260aafaba0d9bf05c5b28b63594e92313e5265b4deb4a2bd35b466d25e3e3aca98bfde9f7d9916c2b3dec3e07db660c2bdab95b69e686f0769e8be039d236213a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd6ef991-53b1-404b-b4c7-b75150927eed\index-dir\the-real-index
Filesize72B
MD575fe6735b27da548ee7d489999191ecc
SHA1e8672cae15674a079a1858ca08c649332aaf8248
SHA256067fd7bbf39770fa186d2ff80367ce53443012ded9c5dabd56449d3e0c16435b
SHA512a79097a6b2f502191de6b3f87fcc90a0b3de0b6abb2a9afd4be707babd7b67131cec45b3f88d740c80cfaf5355e5f2f6ded879b14aaa0eb2a93b587ce778e3f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize327B
MD5198e573f826177b5f71856f1e33c1596
SHA154bdf7960f131665438c3a36530096e5b3b96498
SHA2568822227f1076cbf937a136414c0cbdbef137c7a977b9961530a3e80b636cb05a
SHA512fdfc1c48f91aa7844c2080d7f4254545aa469091140ee3d8f23bc342058e50385885aa7b1f49884f0cacbbd735ee5a2d8d0aefeaf3649dc8dfb9fb242aea6019
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD596159432556d15dacb82ede1b79e6929
SHA11719a9fda4d4346e1437a10ad71ad7fe3d8c77c1
SHA256e66aa292a07c6d9c7f8d1e4066ca73d2ddbcb8bf330cfde9e304e80fdfea09a4
SHA512073b970d57494f2d7cc4298385037f02d9101b7c1234a5e0b2a8daa56e1096abd2ca2e11c4ec502e21ad10e39b56a089353c8e1fb1452754339878606bbcf08c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD53199d38da80583a754cb74bfb36547c6
SHA1f887c6d1156fd01bb5383ee0918f228c90b07df6
SHA25650ec5d54c8587fb8940c3a60a147af504da5ec0bee554155545d7cdb84bb6605
SHA512e855e9ee5cd5d61724aa81f7ee51faf1fb9aac3e97b6644cb6b4525dafec632116f9533a177d584341495bd948894c32b2f0941f324e59108ef0c0de82282a9d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize253B
MD59bd4190d9e9def7ad59dd922c6e3687c
SHA159fb47237ab8a899afaf43fdf3c5a8dec9b0fa5f
SHA256260e14c994f0b91f1ab1c4ea6177cf8ba19542cfda55c057f23c2851c5ae5f3a
SHA512b2ac194d0a922d15d30da655c038c83ca1e6097682f10291b50ec796fe5bb6639b86177f20c42e6b8637df4f60dd261d178b6638cfb9e22576b112dee75a1649
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD5ea11fbd11ff8a9c004055ef86113a825
SHA1cc5414969bfd5070864222b733277e8573acf019
SHA25631457e96e43f3bd5df65c4dd153f08c396d98c0f978b98a4ac5069e7e2ee5a43
SHA512c2b6ab99b6239a38ea743e52e3ab39d39174fc623397efd090279b73c48494a705e883501847eb7994df3dfd2749ad101372fbe411532842340ff142f7e89b95
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\08b99d499107ba17_0
Filesize25KB
MD59ebc429cd6c7bbb877464f5646d2cee7
SHA100431e49fd93574e36d7b866a5cb761b08aa300e
SHA2560c0a6c9f09c6f820022ca95eeb4bf390e1ee7e76cdc84c2e54b99eb6476e3050
SHA512c243140d79d2afa8b3b17106fd516564080ed12a243c1d009ed26daacca111292da9121149d5d03402d5bbde8cbec7effa59959511bbf596def6d7cfe32145dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\297ecea5cebb5dfe_0
Filesize25KB
MD506cbd822993348c775055de1aece997f
SHA1cb490846c05686c0aa3c2bc70c91e68f482b1ce4
SHA25639c4fd1a828b7c715064528e2faab67bc5dcdc4309e90b65e09f21f8ed584357
SHA5120b1a24f9a27e8c64610324e83b3ba98e3ba6e5ff8309098cbe8a720e964c0241cbe61c7e805bf20c43cfc43184627e184c8247c5338c556605e0c13396d8b015
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Filesize116KB
MD5a9fe339c302af3d75557b64e76a1a58e
SHA17c52abe5168cf886066c66f183211b906e970aca
SHA2561ef2f4959f69d1dc21d84ebd166906ed785806227abf3a4ed09fb7db279c7c72
SHA5121801ef21e93f1cb4d1d2ad6049d221e00f9dfb14139802c29ab27e3ef0232aa91ed3122a51a967f9f4d9e9f6bdca1b1c9f99eed8e64c61f19553b44316a5d817
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Filesize216B
MD5996f993bc4988695a394482cfeb9069d
SHA1f21ed86c80f680c3c2877f13bb97eea68aaaf2bc
SHA2566889aebe3cabcc14be87820267667de09a7203bc123455ca4b47e889fe9e0294
SHA51264268998f8a99670374cddb906916e63b6b5eddf076f68a6ca556815957bce1e41f3530ef178d0be63dd84c0425ae026df328841edcfb7b9e970ea6531f5ad4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD57e415d05cccf4b5b765e442d515ade80
SHA130402b9764280e0e31e9d279a7114d8311a974ba
SHA256ebeba6002f3d3ea50407722b3c3f0cd852b1dd942d34e77745412d438d82a17c
SHA51233bc4cc950e44cc9a86ef101adb9bd3d36a50ba07e2868ee21e2e96ac7d6105d69d32cf8ebfc705073022f7886f5e56dd1d0f1c8d2ce331220c1ccbc17c9cb64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD502b81f62d47c99498fdd33c8d2b1524f
SHA1ace2cb62fc84c6e90ea29e465417dc182a09fa0a
SHA25608ccfbdff8a46b9eb34a5ae8c75dd58b2d4e3c0e44360a3533cd9f98132d42bd
SHA5122f5bec0f9fa2797498a2f5ec6f1506f4148cdad8b0d863391b0530f089c9954bdd929ac4162bb436c8928c4c9fc39aabfdb3bb906f3b132619b3d0fba3377bfb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize168B
MD58e8ed95377689e19791b4e3785add9db
SHA18b741206daa5291461958b9a72797e48048c12f9
SHA2565264ba4e7c404c1db6d2f659ea29b18c67b8085434111abb3183d97f060a5f45
SHA5124a08146b03d6e9470cc98cee4b1cff11703a5f8bd7df73c9011cc2114d59acca1fb5b568da478a17e8c41fdc91ddf6e2ab2ae52d8013e7d5bdf9e88859bde350
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize216B
MD53161b5aa2161e003e218f02a74ccb2dc
SHA11226da24afc634af5461fc2d74f1b46f80b1a717
SHA256bc6c2e99705b7501685d9d8735764c9a5434822d692e67e45f5be19b43ecaeae
SHA5125b661c99bbbdd71be56ec69acbdd9093d0f064550e61415822379c926e86119bc0c3c8423df8f1a0643d6941ca232281dd4d2a102993266e702c8690bb397385
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize240B
MD57878ca010e6b849e9f31be0d73f34508
SHA168a2aa189db8734bb9a735f26976dc877bd013a8
SHA25694b571eb24a7154b714a1b07727c6dcaef9e45e2e0fa3bc532f87ddc1dbd1acf
SHA512d0e9a576a5df089dd7f9297a01a60fdca684e25e4bd0a3f8317194adf0a76deafb8e5de54c57f8e07e22a8d8671cc9727ae4b3696c4979ed3a845ea17deaa5a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57eb2b.TMP
Filesize48B
MD5a5359b2ebda4c04fffc3cbf59d647aef
SHA1aa28ce23a1627b877626a875d6ef293cd10cc525
SHA2560021ee07a882c3c017f549cf77565c56b94da93e304ddbf55b384a5b6131f82a
SHA512f1b71dd58308e3af40b3b2e43cfe1bc9eea45fe287339c0502facab2e2d568480f950cb2733799e3b5295e4216c88544ce88ea3b4176e4ee98b9e10807c28bee
-
Filesize
21KB
MD5621b3248cc418344a41871edef1f3d1a
SHA108e58b16ec53a741be58c9be54f715af531c2763
SHA256bd0ada42818a19da3c599062c577ad30dd5fd86442ef68eacca640d4b105e344
SHA5129da8a869383b9abc88ebabcb71f0dceb5be807b467b1151291d3729aca9a79eb981d85a2e656d85baf8bb50b630a6791139282417b5163455a09c3a6b6a4e354
-
Filesize
463B
MD570522e60f97935943b7a93b57d1e5335
SHA1a0d9dee5433f7cf01c1405b4b9e9319333a2c1cf
SHA2563211660a74d57e55642dd336693a2353f82f13a16737c79908a2008f1192e4bb
SHA51233589f13322ca2ef4e1e577784f55ba9fdea3e53e59f341516a378996b8d4d742e457d438ff0d9ea3c03fffb06de2d4cbb1e3dc7989594cbcfd2a12ff1373986
-
Filesize
23KB
MD58e27113489bb1e126e0fb4c8c4ab4282
SHA1ed05d7c9bbc08f796426a8272bc9312379c1f752
SHA2566aeed64fc4a79aea2507b454dfb7870c30b183c4053aec76cc69ddf76cfbaf70
SHA512401cc0e8d4685f1dd9d8195dc12f402a60a31143d3f27d64187f887e45affc6b35398abad70037480b81b5032318527535601b5780b509160dc9c7a67ddca39b
-
Filesize
892B
MD5b81251d843a6ebf6725e5c578717ad6b
SHA1f8b1db8ffa417c1dc61ce00db4a76f7805b7b849
SHA25616483fffd7d08f6b1c7412acd480c20b30803c83c0a00cdf562a38c824c776d6
SHA5124b3f2f9ef193d108277ab69006a1785168b0414aeb9d17ff75f30300c59cec34618729c63a1d105226cfb67bce7fa36eebfa0a27b252e72f30346a176f90eb4b
-
Filesize
19KB
MD541c1930548d8b99ff1dbb64ba7fecb3d
SHA1d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA25616cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
SHA512a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
-
Filesize
49KB
MD5e2774078877f871ea8db6379ff47295f
SHA1cca996d17c5ecee4729428dbc9e7c2f2bc295384
SHA25687a907432b92008e593fa9fa6aebb85fa18051aa159f158d928b4cb1c9e81581
SHA512136152a1bfdc77819c22f22ba11a149745c72f648bcf0a2d7fb32353e552cde26305d360995dac8d873125283da5beacf8111f85a40429aa12605a85bf83c393
-
Filesize
55KB
MD5694844b2314c32fcfd0de5f4954d2a59
SHA16450601fc514f9d39e60dd0be49649b729a1ccfa
SHA2567142bd04a711b95eb8780e1deac78698f3c9211f366d050d8badca3ad76faec2
SHA512d2782d1242824c035374847e4eb917a77461f673089aeab59e3042af3a4cc56790402053f7cbd745589c82a9e0130dd436ca4f776ec0ae959e02ad2b3119a3f0
-
Filesize
49KB
MD5dcc47594d421a9d098f84c3a65ae205f
SHA12e75fdcfd39f12391ba66464d5dd0401993ada0c
SHA256f05a2a35f4ba7dc673abb74eae3350faa531f243cebf2f756f75c623e769c7a1
SHA512e6b7f82e0f386d6ad5a830a2b3e005d114566b8a11ddc214906b14e83f4d87787ae8f154ea88502b22d50773fd0c716bffbf06bf8689f59fcb0866622e8b626c
-
Filesize
49KB
MD5024f902685e8aaa0394c6e5432469c9f
SHA1bfef0187a2cf1a8caf21f49d9960e3d8ee194a52
SHA256045fc7d840dd1918b8d4c2d0155c422a91de5696322b850e94e87e48e32bf4e2
SHA512214a3865490fdefe851a1cf918023bf74265d5f3ffbc0680b193e7bd2e76f1f81f187ead0702617b36de752fd4d3df4202188cf2eb6ca45f38e16ca34b6b7dd1
-
Filesize
55KB
MD53dcb714f1527638a025424497e99e5c0
SHA10c5828934755b157abba882ef9ca30079640f244
SHA256b9cfb7bb22c230971c3209b7d39bf2d59db20fc55bbbb691d7f5fda522122827
SHA5124fdc7ef51c95e4c279d775402c08e1a97600aa7d94f9ca79bc79c4e44bfac7bb110baa89bb8721a93e91a94fc9cf741c5d8d00e85a1340ae4997fb8820192f70
-
Filesize
55KB
MD55b28d4fd24e7d9d0caaa4426bc2b2f66
SHA17d8beb26825c8ca51ee7f094f43c4710f88057e5
SHA2569255d453136a4462a813779cc4c1bbf2d6bc0803b842627b2ab2caf00243711b
SHA5129f05f3e9312d7896a4f57136c5d6805d8cf2385d249536566e0184d025fd1e5cbe757dac3cec46bef84e8d2e52e2300ca6134688ca3f9cfed25f32e74758c0fd
-
Filesize
55KB
MD5862aeb59a2e6c7ca492848b19ec8352d
SHA174d1d763daa97c26fe252a52e9c826220f65b3e0
SHA256db15cc0d15188e5d0a880fbdf3707eb59166c0839932ebc9fdc98cdb5dad6d6d
SHA5120fef633605cabb3901a983715a2e98ff1fafa3fbbdf741a258e79ef20b0fb8c6c21a498a8afb316c0a9b6ec59f7632c8a3b8be94c8396f024d072657b48ffef0
-
Filesize
55KB
MD5351f01c722f1ec5cc9778555931e5b39
SHA1a3e1e9acbceb31e9e51601cd7c7bac7ee8e0de38
SHA256289c9c24fd5017ed971be6cc093c224b47fd999efd39f5330cd8c3458e3b6b37
SHA5123fb27b2d163da48a79450f217e817753e8d071b9c40b883d504d0d14d890bc04121a17733bb1befa704c1172ff7eba20169fea3f129cf294a058759d6cbd1fcf
-
Filesize
49KB
MD55ccdcacd32790604bb5d91305ef471d9
SHA166279ad942b25e2a71282699bee684d5aebee063
SHA256bdb77db35b1d526b69634eb678e4704a3b924efa28205a0ee7aeb0cc977e5301
SHA5126bc8b53f11de90c8df8bd103fa1acb7a9928b4909c6ec4044cab9324c2cabd0ba8b5aa401520d89e442dbac4518edfd1e345e114ad91ab52511ce9c46ec63b93
-
Filesize
55KB
MD5cc0cc4d3be0239a3298e2c928d8be371
SHA13157615759093dbe5c9e792d86c0719f7d360617
SHA2560358c481be0f6e6ae80cad99d5d3056bd9458781f85bde9dd7189fde439cfcc1
SHA5125301076ab03406b07547eb55fdd3501f6bb29aca83d0fbc2be21aa18a54c9a8d0c1eb1097f314c825d7bcb2bb81fdb5237ff9bfda11c501fc013b80eb6e022be
-
Filesize
55KB
MD5e91712c9c82998e55679c4ab92cdb4ca
SHA1ea86c583181babb177b91b99676906c93376e2bd
SHA256ac4e7f98fdea62c383ccda79ea966a3a33e294322a1aedbb99025019ec9c3031
SHA512a0865d7e20e368b2c02224566f098d000effee121fd21832c351caec8ab99d042d29ea0f007c4486d35cdc7f30e10006d40cc2ef53075c7c624bf4a96c5544fe
-
Filesize
55KB
MD5e26f5e2252d99f08c7a745cfc1700a71
SHA100725d8cc85e89a41a13fab1f1b6129c3e110bef
SHA2565dd7fe15d60d59fbf0dad5b38205a84117441ffd2fb80cb65de44bc4a5db0048
SHA51208ccdb97ac0cd8c7e20b9bd7f8f5d040cbd91397ba3a2ab2f3df1bbedd2ce0ab989cde9dd9f36fe3cf1943fe3a30bcc6cc50c84a827665462bd35b82ba04396d
-
Filesize
55KB
MD5650ad6c8ff84f6d17f7c5c829e2b58c3
SHA1323d7ddb3a09118e0ba156c0da64558882c9accd
SHA25691e05f92e63e187612212bf2f68aeb8005089fb0acae518339aa67665724d718
SHA512229bb1a7d616382796c7020dcec14263ee514b30a08f7160f0d129418bb151d19f12c6f6e5e6fddc9106ac5510bb30c333cf3f9e688c355f71a612c1b16e68bf
-
Filesize
55KB
MD561d09b43fd1347787943526611199d32
SHA1804e56bfb0dd835a659ce171104749b3b0e275ca
SHA256981fb3642d3a0e2db9a15d0f4466d8bfd7312fc78664e1ab7caf40d562008b6d
SHA512e408e473694507c537ffbe19ea7eff648867d14546926f83ed4e8907097a77d1c0a4ae3dd670d6972ff7fa2814433c516777b5bff5e00bc060786c9407f4bae8
-
Filesize
392B
MD5ef40c0baa795992685cdc7187ecafe54
SHA17b91c57698c10beb1a37f1171f1d667e727da213
SHA2564311ee4c746b694b09098d21f2edcdfd5ff8ce036718f3537b68538e13e4cec0
SHA512625e62701d38e5a83ba102401af175c65e8317cf029424ee803ac8d2f6471bb6c3d1a6fdc02078258c167e9e411897f06d4eab222b5b393a855f57cfbcaddef0
-
Filesize
392B
MD529eefc2e4bc0a8cde9be10bc5c91cd48
SHA1076a5dc7a3b272b11a952fe35ec9afc4fd8a836c
SHA256d1c7c0a6b45764a55a8cfe4f5dab30305b2baccd213b7d5c5ad7ad11a203dff7
SHA5127679320f65658284f13026cef7e315e5190aa581b00e8c59b805f6cc4dbdc201a6afd635d3c27e900affc6ec4e603390dfbcb7575912f52cab7bec1ad73f3498
-
Filesize
392B
MD5c0edd71da80b0f4a2e55b9136c61ca03
SHA1f5d93bcc16fa75e369a79758d76c98f8e4d7ae60
SHA256e5fee395d84772c4d89f88a6fbbb9eee27aa3b5af1a46764766e43e849ab6d30
SHA512ffe43686a591ba9db18a9c8c86c0dc66c830d38d4e5191bf3a9bf53ab75dd4c8727a5264ddec3285c3b7d72eb5445b2b3ddab2d85ce1a3a6558c2688ffcac150
-
Filesize
392B
MD5f6d0aab90f9050a6279751a1322226b6
SHA13adb12371e30537862dfd18df6f615ca4866f261
SHA25633721844a7114e3f2d93e9ce4877788aff2a8a27aabfac33a462357a9e30757f
SHA512c2914c419a6b05814b31028b5d07cb745ff1fa4d502e378237d5cbac43011c7c897b7bfd9d498204686b66aec39180474983eb3d2697ac5e4bd23caad9c831ee
-
Filesize
392B
MD52ba925b0a5b2042b06921bcfe795fbfa
SHA101a66fcfdaf9c953d7709fd6646ef732d0b8edee
SHA2568137baf6a94d2f0936d608f6c5988d62ef62934f7a41cf5e0f2b83d22e0a0b60
SHA512285615a41721027bf9d7ad7ee225b5276b0fe780b8a0372483c7be3ffd7d37c2458afe7d4c882f95c3dbe62f7958135d2381e0f9fb18ff4d1ffb4cb5ab047c3e
-
Filesize
392B
MD5b21b5979073efe52c6133e0d352059df
SHA1a05ae518c9649b1c6790ff9aebfd948d348e85ba
SHA256d28f6e7b1e5dafff5148149734619cb0c45077c5be600cf61a49825d9709940e
SHA512070d2d2d48f64a2d2719e7640dc2dd2c11970b9a57371da4b6395380df0d220884e883b280a56116b25a989fdd5263b9a2a2758d6ba1a9a797e523ff64dc0f03
-
Filesize
392B
MD567ec8752a33954ee29ead914ab878bc7
SHA1655482a65acd9292c04d71322c2efabee0bd8f54
SHA2560bd2958e15f47e15f1af6bc6d0980b023a40bf256cf28ef9d5373276fa8918c2
SHA512a820b96785ce7aabc6752ced2f392e265242026ae2589115335d0b03d12280033442c200d64242355bd99cf0d349e1fef52676afabdcac89c01b23a1f892b3d3
-
Filesize
392B
MD56585695187710e9e88bbf22acd247c5e
SHA1cf4b42d7aaf5e5088acaaf76232c70ddf85811f8
SHA256728d0add5797543c995ef6466d26545ca7436a44cdac3cf712b48667fdb76e55
SHA512ba8f6613e4684798d4818ed563a0d137cdf80fbadf9621f130fe617941b179799b025c68aef054cb36d889ca1b0d1e8a7f9a289910754106f5af890978d7da4a
-
Filesize
392B
MD5e07211a3efea60b3d93737cd7a1a8d34
SHA1cd1172c6e029d5ea56e4570c7db4862be1f442e3
SHA25602787353e1be76c0482c52e7010790483c6c592304ad50d23e5803cfa7bfeacc
SHA512f3efa9fa0d54e927f98f325a3afd399d6b966850391f2b3c10678fb1a2ff45758cbcae994e7fe6651c4a05d56be01b9fedd3ce342e9f867223e1861d757d1a80
-
Filesize
392B
MD5d660574200b1c15215ee9924467bb2e4
SHA146f6bb2c8c742ba3e6839d676ae9a4cf14305685
SHA256d68c739a611921f0129634fbcc93b0e618442bc01c93519617327a509f5467ea
SHA51228400c360a2fb83d531c665c781d5b559094878ad8457e7d4b28a7f4e1bfe614f357d986ead91c358318b2f8df173aed8afdbc4a85caf1049e3c2cbba98e370f
-
Filesize
392B
MD5ff1614210c1acf79d8782672d6f3c1b8
SHA15b4ba8914a4dc8f8502fc7c955d6b6709f7b5558
SHA256408cb5f869656294d3313c35f34782c8c869a787ec7a8f02c11dd7e229507042
SHA512f1116af5226df57c1714ef85a8103fbcdd1dd77209a9d0265d5d09637c31393a64fdf989173df6fd21ae9e404dfb7eb16893c32fccc9b705540bcf85f471d1ac
-
Filesize
392B
MD5e4c54b98742db1d4c34e0c18855a2fe5
SHA1b19303577cf7e6af9d4143c2ebfc8d4108287821
SHA2564d3985ac1d731744aa0c1a1aea2ced799a9b60a8dd336f0c386008669dd2680b
SHA5129c709e03396d420272389f3a3cd66a7ea8de1c4b4b6d562b1be46e9f5789845535c9dc79f5d4f4821449663f76e09e7d01add2339185fa10c593204fe7780c53
-
Filesize
392B
MD5699292035aa25923b95bcf07fc9a33bf
SHA141b3b333866246e1d33957f424bf34c84cc66770
SHA256fe7aee23ae761a56557a74eb9f263b4f830a7a5aa3ddfb465318dfe51c414d49
SHA512757759691e1272595fc059e7d1220ad87888d4b7f5641e86e49ecbcfb81f906f18e9ada2823b970200d25daa1bc326d8be0dab7464681687c872e7d8487c3f53
-
Filesize
392B
MD586206a5bffa3257769cbcb3d4b57eff2
SHA15dc5cba684a0cc7146dce106ada0c3db12bc4ca0
SHA256a301ec3c57f528107bfa856e988e07bc48a79edfe7aa92197d8393e69aa701a5
SHA51253296a3aa7bb28d3ca15cc22776bc7174b4ed02d056addb50299fa7dd1588b0a55258f01fa9876b4914196e87525a36cde187f6089b9b3b9814ce05d8bca0958
-
Filesize
392B
MD59b1721d0620474c443411f128600bf95
SHA1ed64e77914a0521b825484a890fa111dfa9f9d9e
SHA256339ee7d5d65cf369004f1eca160c64b91b218a2b2dd4d04fe10c8f313b715caa
SHA512b8f93e6e104a3b35e10a716dacc9aa5efafe24117acfc7a7f5c359a0a5672cd49d616803b9db53a7a3c847f5477ee6cbe26b412a6c26afb45c9084ded074fbc0
-
Filesize
392B
MD57ba21f52e1dad180ecd9643d7f87e27f
SHA19e60e743a7bcf6f3d5f846dacfeb55acaa969f82
SHA25609f4c92134d81730fa960a9e8b8c2e053cccd6a68cc3a79644458f2a3d54bb7e
SHA5127703cda7996e61b4eb24bebedc6d31be31a8473eebc3f57bdede3189b98449a3213496e6c64ad95b042b0b19c0972d88bcbe74a79112cfb4a18bf33a2333ed6d
-
Filesize
392B
MD5d262ada915970599c145c792816322b0
SHA150dc88965c4ef043b8300a75d206910557bcd651
SHA256af0cb4c7145d52da333b491d1cc2c86d927cf1783779084dcc00889458e8a12f
SHA51282d5a40bd203b2a636c7259f667721784ecbb70a716698bc0efab8b4a71ad6a2e2fd002fa2eba7719ba326c8981b08ba3024eee944757cd56bb1e8194924b591
-
Filesize
392B
MD5ef420c224d22a541e0d2fd5d2eb67d07
SHA13043ffcba59b5a8a8e380905a2ffdd7ba292655d
SHA256a4d72227d5382d2dbe52af431d87b01f05d5fa2f6ece308e227e0436db24f950
SHA5124f6b5108769601e418ca2420ff0811cce5bcc3c60065ae64dc1a86b8ce43d14d831bb0282dd15a3a8e9cebccc0797f3ffaa3074cf70126ed500b37c8339dfef7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
Filesize152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5b8b0fdb506eb368b3a0f95a8cf07b6d9
SHA11d3402337e9a616e09eb0b68d93b9dd81dc04296
SHA2563a3fdd4de514395b787131fdb2a1e6b276e6d16d8477082e5f230919a10afe74
SHA512b777fd3a81a3eff464fec85ad88231bcc9f33c766b9af5899b938166f21aa43d56d230f1be17ce027a85d5725278ab9384ccf1ec744561d823caee708ed4a685
-
Filesize
36B
MD5825dc3a4c0a94200be3b4ca4117c43ff
SHA120e5e2ecbcb76babc05c3816d69f31c2f79dec4b
SHA25629fd9e30811446473be399b41f586ec4415bb45932d0e3f0ed16a726aab19e81
SHA51232b84a3ff2132b18c6d758701876c74b9bfd3437972721fbc5d24b2031f13ffee9ad38f3f9c80a6b00934f94623bfdd32890ab6780004b9c533e9334fafc3f03
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133885666415876394.txt
Filesize3KB
MD56c7c5879f1c75b60ca6fe7048fdf88b6
SHA1e3faf0e19132003dfc8617a40933f760ec6b64c4
SHA2565391afca6e19b795f4790c36b762d967859b8dcab7f34f40cd3e9d02fb8ab74c
SHA51223a865f4b8d9b04b85d85c7e81a24ca6e28b12ad74acc9256ac564b437adeb0c64cb5fdfc723dde91f38a6c9363e63350791eba9d9217d67b9b387ea8ec209bb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize2KB
MD5c09de3badf891f7d011834255dd5583b
SHA1e28961ff4f5344c12600ed2e674da1121a04d847
SHA2568c3efdb12a6da3804b603106b2aba763ed4a748d7ab6d0e9d01c76d218ab52c1
SHA5126ec0fe0bb838e43a347c731a2c12a7bc72161d55ee240d54f2af4cd2cb11fecefe7d43761129c1e003b0bad239e732b9cf222e671ac9e1852f960d3f37a83f05
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize2KB
MD59ff7ac0aa726b975c9c37105e3db4d31
SHA14df15d634a5410ab20801acf903be21d426b82f3
SHA256d1b3613159744a6b037b04a8c3ab81e7e69f5fcc9ed3451f5fc51029f1ee3462
SHA51210fc7e2c67fa28f056fbbb9b8a5ae13aa2df9643620f078e9357ff3bcc5421cfd8e5ce10c696bc2b26b1262121b85ee0fa6cfb7af266fce51c3793ee7ed1bf6c
-
Filesize
565KB
MD5debca559478b491bd58c4594657f4216
SHA1b9b760b8dc7b969f1ce9a5fedd8f7441a55e6e22
SHA2566de332811fc74b85637326edb00a03c7c8687f7ef5c73fecaee870e037dcc0da
SHA5121af6215f5d2dbfbf52cc444d8b34d2fcd55a0c2c6c4c4ecf3e95c492157f03c94af66f7d4e607f1e47e3fb7845118db8841d7eb232acd34ed777751e94033cb9
-
Filesize
243B
MD56a737ec50ef18c2672be9f6f5ecd7c77
SHA118b0d6c51cbd96246bb939457b2eb8cc481d6172
SHA2560f636482f417729d83ed773d42f24ee27473f525035aa8a20f78de5b917e11a7
SHA512aed1693a45aab76b592b252b14efae182a043489e5fb2c0288d03f94694b2e1a315e949e3289770d586591629b1ddc73bc22e84a68cbf2d3d9ebcf8d2b005fdd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD53ee1d54eda312eb6ac495ca0f5cf0760
SHA100ec214b582f1d20ad298dbec503223c6cd44efb
SHA25609785e348d052c101d068ff3843d4961fbf4497103507893608cd436ad84e87b
SHA51219f22eae70d94e6304672a102fd4b8a9d78e9aeaa330432dc5ce93d7256a29f81fd536445df1819fcfbba8e4dec76ac442b945b4b3736cf509a8249bdacd37e9
-
Filesize
83KB
MD510d16e657af3bc025b925f9b83ed8fb6
SHA188a226d8feff248e0a0246e28dcb8db29114a8b4
SHA256ac12a3faa457ae0bb5c94b75b03717c610b221317e9718f04bbad54e0acd382a
SHA512f953522760f0dbdc66a5857bcd88895fcf2fed6eb4efcf9b7295fcbdf63b6aedf1af7ec121e820fb45f342078006f03083a2998c21e4aa463d155a9b5b621961
-
Filesize
314KB
MD52dd0a1de870af34d48d43b7cad82b8d9
SHA1440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e
SHA256057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32
SHA51283df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff
-
Filesize
975B
MD50e5fea82cc4f4a8225532e5b2f45c6c8
SHA1b163d952a4a5b0c3ea40da2b47f95e624e344c96
SHA25681b5f50491579127d13e050847ef6d817265ab4b70d2796fb74021463b778bb9
SHA512051507296cd4d51ce4d34f0d1dd0a078f7598645ec42321335cec5719152c05dc611c663c67b3265e3baf14fd6e0c93788e2d0b04c6e5c16f4203dbd206b3f44
-
Filesize
826B
MD537a05031bec9d3e093388407848af66f
SHA15b48a5b72097ad98eacf54e956e94d26710a0493
SHA256cf38f4f8663028beff3a7650a9d426b4116891e8547029b66b8d2a13fad63a48
SHA512db3af55b93e901778a74f462af1f80a3e4181b251b061f858a3a6dadc77f2eaf4760c30f4ef9ae5560418eadb6133d474289c3b84c0e89615670af722d8dab9f
-
Filesize
7.8MB
MD550641cd6557c92a8d6f5f2d9eca2d0c2
SHA1942fb8a578d330ed8476733d0752d3f14a1de93b
SHA2564f66b87be18c4258e6d694c1204d8d4c2f778663257d7d812a8fd3ce957724ff
SHA512dcd9dffa332fbcb107fec4e7b2446e3d061858dc33a68920edc9faf5f28a4aac28d726c08bd4bf2b3b0e4ccd1215ba46bf5767a95602e985b8e8b2b0ac46306a
-
Filesize
12KB
MD58ce8fc61248ec439225bdd3a71ad4be9
SHA1881d4c3f400b74fdde172df440a2eddb22eb90f6
SHA25615ef265d305f4a1eac11fc0e65515b94b115cf6cbb498597125fa3a8a1af44f5
SHA512fe66db34bde67304091281872510354c8381f2d1cf053b91dcd2ff16839e6e58969b2c4cb8f70544f5ddef2e7898af18aaaacb074fb2d51883687034ec18cdd9
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe
Filesize1.6MB
MD58add121fa398ebf83e8b5db8f17b45e0
SHA1c8107e5c5e20349a39d32f424668139a36e6cfd0
SHA25635c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413
SHA5128f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273
-
Filesize
28B
MD5df8394082a4e5b362bdcb17390f6676d
SHA15750248ff490ceec03d17ee9811ac70176f46614
SHA256da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878
SHA5128ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d
-
Filesize
10.2MB
MD5f6a3d38aa0ae08c3294d6ed26266693f
SHA19ced15d08ffddb01db3912d8af14fb6cc91773f2
SHA256c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad
SHA512814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515
-
Filesize
6.7MB
MD5f7d94750703f0c1ddd1edd36f6d0371d
SHA1cc9b95e5952e1c870f7be55d3c77020e56c34b57
SHA256659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d
SHA512af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa
-
Filesize
125KB
MD5597de376b1f80c06d501415dd973dcec
SHA1629c9649ced38fd815124221b80c9d9c59a85e74
SHA256f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446
SHA512072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat
Filesize1KB
MD5b4b2f1a6c7a905781be7d877487fc665
SHA17ee27672d89940e96bcb7616560a4bef8d8af76c
SHA2566246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f
SHA512f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\zkjyhpxjhoabwckn.sys
Filesize674KB
MD5b2233d1efb0b7a897ea477a66cd08227
SHA1835a198a11c9d106fc6aabe26b9b3e59f6ec68fd
SHA2565fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da
SHA5126ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37
-
Filesize
13.6MB
MD59bb6ed6bccc6c0ecebde9e3df55d76de
SHA11d9f9e5b4f406ae8644b7587a704872f7816ff10
SHA256be03ef76d2cdfddb716fe410a36349d2ac19282fafb5624c7faea304f8b68f7f
SHA5128701f96102f6e3489a525e357cd1977a0f4c80f39a928e45367dbfb01b4bd4b778ceb807fb4bd4ed41c71cd42796d5a42c89da07d16ec97414eb763ec0bba87a
-
Filesize
17KB
MD5352c9d71fa5ab9e8771ce9e1937d88e9
SHA17ef6ee09896dd5867cff056c58b889bb33706913
SHA2563d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
SHA5126c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
-
Filesize
3.8MB
MD5db2155d175a945fd8c53bafd47a0ef8c
SHA1726711f9606c55700273ed0f7e84e7a6e1a898b9
SHA2564938a057fefe6a7e57edad3bf130112839ffc5d33828d3a7336fd78dafde006c
SHA512a8b72f174ea1a1d9e996bafb5e72ad1a76f7d0088e214838838cc42eb6a80b95223219df7db9b7803e37144f83ee46fa3a87514f08017b428d967f18c5b0b874
-
C:\Users\Public\Documents\KCDSQSMIX-MANUAL.txt.E9AF0B5EFDE9A48FDA7C5F80A8DCC393F0C41A7BDBCF06B95D15CE1A12798FB9
Filesize8KB
MD500d28ae7722113bb626eaa68a55d42fb
SHA155fbeb7ecbed7526c11c39b8a4eafcd52f04e133
SHA2563d34067676379b6d518cc20d8825755cc81a5a986ff2c6a7cdad4d8e92a5aa2c
SHA512fce6a5a7bcaedf658867cab8bd2f91a733bd1aaf3dcf8d11cf6c958f98aa17e05c073860e8348be38c0e123c1ab8049363e842a550b2b8ff51bb93bfb1660469
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5f2d8fe158d5361fc1d4b794a7255835a
SHA16c8744fa70651f629ed887cb76b6bc1bed304af9
SHA2565bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
SHA512946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Filesize551B
MD57bf61e84e614585030a26b0b148f4d79
SHA1c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA25638ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
SHA512ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\Notification\notification.bundle.js.LICENSE.txt
Filesize1KB
MD58595bdd96ab7d24cc60eb749ce1b8b82
SHA13b612cc3d05e372c5ac91124f3756bbf099b378d
SHA256363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
SHA512555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5712_2064128110\json\i18n-tokenized-card\fr\strings.json
Filesize2KB
MD5cd247582beb274ca64f720aa588ffbc0
SHA14aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA256c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
SHA512bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
-
Filesize
1KB
MD5ee002cb9e51bb8dfa89640a406a1090a
SHA149ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA2563dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
-
Filesize
1.1MB
MD50e3ea2aa2bc4484c8aebb7e348d8e680
SHA155f802e1a00a6988236882ae02f455648ab54114
SHA25625ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7
SHA51245b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428
-
Filesize
8KB
MD54fd912f38c6ed1bb4f73f749f6b06907
SHA11e49916d47cb47b5348b71ec3a4e2f0a68e6aa0f
SHA2564a436d5ff3180e996375735769a7d76c0e8b53ab0111a407d6e58370b73221be
SHA512f61ee760022d6eb3bcc779b0bd67ef2dc2bedd7904924ffee70e3a10682a50164bb4c88e9f1314e9b1f6a8e10d471a787020c6b38dfd96f16e81ca0ad147cde8
-
Filesize
5KB
MD5397d1e1261faa81303c7f639f219923f
SHA1ef7b960369a130730805ea9f96b6ec72b8065921
SHA256cce27276686852f0d74b184fe58ba21c176cec417c3e4a9fd8a8382044867b29
SHA5121f2836b0aeff7f1ef4301bba2e8512dd32a52a932d1ab81276c4a62d0626d0a09c221b98f58f5f7968c8fe7175a5851141a44e0da4e204cfa4360adb1046c76d
-
Filesize
47KB
MD5310e1da2344ba6ca96666fb639840ea9
SHA1e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA25667401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
SHA51262ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
-
Filesize
1KB
MD5ccbe044ee28f3ca7f625aaff01ec03d8
SHA1d68663df272e14ff77e2144f2b924052ad881769
SHA2565c418fc64d4f1732b0f01957d74c74133262e6369ae9c91045ccd63a459f41e6
SHA512fb617286e617dd5ce78e638001baf5da7675c913d56af6bd9686b2511c915b7ba40196b2b0eeb700cfaccabf04e8dbdd0f23b7372f0b15b0b7edde7e29d62b31
-
Filesize
36KB
MD5aded94cd9381de1770ac079f04874759
SHA17b350fb95fea777f103547def58507d350e826e4
SHA2566aa32b2f54c55aba56b163ddcbafe3b175de2cecd1564f7a5d35063397f79ed7
SHA5124e927c2e49772e65f5449e2558b41904a50a0ce6bd868b822b5c5d3c633fcc5dd3da03803f7e407e49c09a9588a70f8beb4bf1276790c710d0767b863f6a284b
-
Filesize
4KB
MD57b764da83692d6bf10638ac6330988c8
SHA16bcf68683728bfa614ca3e464f44f0656bb25584
SHA256873f6abeab0a4863f9ab3ddca91612e4f89ffcb10b44129ee0c05c778e76744d
SHA5123261c3a5f3fc2fe683e5ec4722837650941c8f08834bf478a4d70528d26d572729ee9a0d8f1bc926ce54e585aa94e6a567d8b7d76f10427e5464adc3ab8aefda
-
Filesize
2KB
MD563665dc71700e9381c9efeb1d6b7d0fd
SHA1fab4955dc3f02e100115e1407ea79c5970120feb
SHA25655e93493b040707fb26370cc502b3dba2aa9c6ebe29d65bd64f9bef8af697176
SHA512d7d719982dc1d328cb62a16e52bf32f0cadb631881938d599a3bb8366a66193fa9320eefdf85ab4f7902aa4c12be7643cec550ea2480d78ec0e9e2bfa60896c9