cb49c00e64432e39d64529c2d9f593d67f98daa5a315fb9e7959bbb466b08265

Analysis

user interaction
yes
max time kernel
118s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AlexSpoofer.exe
Size 2.1MB
Sample260916-p5dnhsvv9r
SHA256 cb49c00e64432e39d64529c2d9f593d67f98daa5a315fb9e7959bbb466b08265
MD5 4d6cef1bc00b629fe9317abc058fe599
SHA1 17eab6822240bcf36171b210aba4dc5a74340659
SHA512 dd9cf1159edebeb776e93603e0043e72f10ff10c5a3c876587e72b1796d3477e3362b28d1172adc5b161227272ddc39d07219702090b7b44961e04ce974d7e4e
SSDEEP 49152:+B0N/aFPx+wDHohU9pvCyzAmkylaTYbyb1geBajRIdstndXU+i:+B0APx9zoAaYbm1gcWysxtU
TLSH
T1EDA533444C44BFCDC4D30374AB26B966F909F4AC2F1A17EB4A5C8EEE09939D6E538136
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
137	1744	Process not Found
140	1744	Process not Found
142	1744	Process not Found
145	1744	Process not Found
147	1744	Process not Found

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	AlexSpoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\stopper.bat	AlexSpoofer.exe

Executes dropped EXE 1 IoCs

pid	Process
3932	AlexSpoofer.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes a VBScript file via the Windows Script Host. 1 TTPs 12 IoCs

execution

Visual Basic

T1059.005

pid	Process
3676	WScript.exe
3828	WScript.exe
1704	WScript.exe
1920	WScript.exe
4416	WScript.exe
4396	WScript.exe
912	WScript.exe
800	WScript.exe
1744	WScript.exe
1772	WScript.exe
4132	WScript.exe
3988	WScript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3656_1315906286\manifest.json	msedge.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1780	sc.exe
3460	sc.exe
3420	sc.exe
4632	sc.exe
4904	sc.exe
2516	sc.exe
2620	sc.exe
772	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3100	cmd.exe
812	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2564	msedge.exe
1268	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AlexSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AlexSpoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AlexSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AlexSpoofer.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3432	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340368762578736"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{9209330C-DF9A-4AC0-9301-FD679C249EC2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	AlexSpoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{F447E953-5CC3-4448-96FC-90DC14FAD45A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2412	reg.exe
5008	reg.exe
3744	reg.exe
4696	reg.exe
3392	reg.exe
3284	reg.exe
4780	reg.exe
2976	reg.exe
4792	reg.exe
3392	reg.exe
4872	reg.exe
2164	reg.exe
1708	reg.exe
4808	reg.exe
4904	reg.exe
5056	reg.exe
1368	reg.exe
4252	reg.exe
3920	reg.exe
688	reg.exe
548	reg.exe
1256	reg.exe
5076	reg.exe
1680	reg.exe
3344	reg.exe
1648	reg.exe
4660	reg.exe
3328	reg.exe
4732	reg.exe
3244	reg.exe
4732	reg.exe
452	reg.exe
4452	reg.exe
1556	reg.exe
4872	reg.exe
1772	reg.exe
1760	reg.exe
4612	reg.exe
4416	reg.exe
1408	reg.exe
3376	reg.exe
2220	reg.exe
4388	reg.exe
4580	reg.exe
4808	reg.exe
464	reg.exe
3868	reg.exe
2240	reg.exe
216	reg.exe
2736	reg.exe
4248	reg.exe
3116	reg.exe
2424	reg.exe
1196	reg.exe
732	reg.exe
1708	reg.exe
2564	reg.exe
2952	reg.exe
732	reg.exe
2472	reg.exe
3988	reg.exe
1436	reg.exe
3080	reg.exe
4416	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3932	AlexSpoofer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3932	AlexSpoofer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3932	1672	AlexSpoofer.exe	86
PID 3932 wrote to memory of 1240	3932	AlexSpoofer.exe	90
PID 1240 wrote to memory of 2880	1240	msedge.exe	91
PID 1240 wrote to memory of 2564	1240	msedge.exe	92
PID 1240 wrote to memory of 216	1240	msedge.exe	93
PID 1240 wrote to memory of 216	1240	msedge.exe	93
PID 1240 wrote to memory of 216	1240	msedge.exe	93
PID 1240 wrote to memory of 4888	1240	msedge.exe	94
PID 1240 wrote to memory of 4888	1240	msedge.exe	94
PID 1240 wrote to memory of 1920	1240	msedge.exe	96
PID 1240 wrote to memory of 4028	1240	msedge.exe	97
PID 1240 wrote to memory of 1920	1240	msedge.exe	96
PID 1240 wrote to memory of 1920	1240	msedge.exe	96
PID 1240 wrote to memory of 4028	1240	msedge.exe	97
PID 1240 wrote to memory of 4028	1240	msedge.exe	97
PID 1240 wrote to memory of 1104	1240	msedge.exe	98
PID 1240 wrote to memory of 1104	1240	msedge.exe	98
PID 1240 wrote to memory of 1104	1240	msedge.exe	98
PID 1240 wrote to memory of 3272	1240	msedge.exe	99
PID 1240 wrote to memory of 3272	1240	msedge.exe	99
PID 1240 wrote to memory of 3272	1240	msedge.exe	99
PID 1240 wrote to memory of 2092	1240	msedge.exe	101
PID 1240 wrote to memory of 2092	1240	msedge.exe	101
PID 1240 wrote to memory of 912	1240	msedge.exe	102
PID 1240 wrote to memory of 912	1240	msedge.exe	102
PID 1240 wrote to memory of 4236	1240	msedge.exe	104
PID 1240 wrote to memory of 4236	1240	msedge.exe	104
PID 1240 wrote to memory of 4252	1240	msedge.exe	105
PID 1240 wrote to memory of 4252	1240	msedge.exe	105
PID 1240 wrote to memory of 3656	1240	msedge.exe	106
PID 3656 wrote to memory of 3360	3656	msedge.exe	107
PID 3656 wrote to memory of 1268	3656	msedge.exe	109
PID 3656 wrote to memory of 948	3656	msedge.exe	110
PID 3656 wrote to memory of 948	3656	msedge.exe	110
PID 3656 wrote to memory of 948	3656	msedge.exe	110
PID 3656 wrote to memory of 5036	3656	msedge.exe	111
PID 3656 wrote to memory of 5036	3656	msedge.exe	111
PID 3656 wrote to memory of 4132	3656	msedge.exe	114
PID 3656 wrote to memory of 1808	3656	msedge.exe	138
PID 3656 wrote to memory of 1808	3656	msedge.exe	138
PID 3656 wrote to memory of 464	3656	msedge.exe	137
PID 3656 wrote to memory of 464	3656	msedge.exe	137
PID 3656 wrote to memory of 2356	3656	msedge.exe	198
PID 3656 wrote to memory of 2356	3656	msedge.exe	198
PID 3656 wrote to memory of 220	3656	msedge.exe	118
PID 3656 wrote to memory of 220	3656	msedge.exe	118
PID 3656 wrote to memory of 1436	3656	msedge.exe	199
PID 3656 wrote to memory of 1436	3656	msedge.exe	199
PID 3656 wrote to memory of 4956	3656	msedge.exe	121
PID 3656 wrote to memory of 4956	3656	msedge.exe	121
PID 3656 wrote to memory of 1552	3656	msedge.exe	122
PID 3656 wrote to memory of 1552	3656	msedge.exe	122
PID 3932 wrote to memory of 3100	3932	AlexSpoofer.exe	123
PID 3100 wrote to memory of 5004	3100	cmd.exe	239
PID 3100 wrote to memory of 4352	3100	cmd.exe	218
PID 3100 wrote to memory of 912	3100	cmd.exe	127
PID 912 wrote to memory of 3744	912	WScript.exe	267
PID 912 wrote to memory of 2740	912	WScript.exe	297
PID 912 wrote to memory of 1592	912	WScript.exe	298
PID 912 wrote to memory of 4036	912	WScript.exe	134
PID 912 wrote to memory of 3956	912	WScript.exe	136
PID 912 wrote to memory of 1808	912	WScript.exe	249
PID 912 wrote to memory of 2868	912	WScript.exe	140
PID 912 wrote to memory of 2548	912	WScript.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2740	attrib.exe
4000	attrib.exe
4388	attrib.exe
3500	attrib.exe
4216	attrib.exe

C:\Users\Admin\AppData\Local\Temp\AlexSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\AlexSpoofer.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\07220E7B\AlexSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\07220E7B\AlexSpoofer.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/manlikealex91
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa3250c188,0x7ffa3250c194,0x7ffa3250c1a0
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,10480354209450704843,424465542186238972,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      System Time Discovery
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,16871661975897108849,6634312352555328035,262144 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11991199759459070059,11323346225473674977,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1590105021471583788,1020632188175033343,2097152 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16538927157898700522,11526024480507463019,2097152 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,16053026272464737915,8961262204044666789,2097152 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,7688570996761963718,8954565479039129907,2097152 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5799778748975714853,15516789801262610383,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4233958035789997770,4052750249514630348,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,14115532392116009163,14980454463745874685,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,620939626505078747,7389448994071930993,524288 --field-trial-handle=2292,i,11694337622073375829,4189773727375901242,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa3250c188,0x7ffa3250c194,0x7ffa3250c1a0
        5⤵
        
        PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,7949631719228713563,8782786187953365021,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3525692151553626551,17496908919815655675,262144 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
        5⤵
        
        PID:948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,2482640106739050980,13601328967406173790,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,397280231648670254,16202367911262957321,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,397280231648670254,16202367911262957321,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        5⤵
        
        PID:4132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,15904619224946955200,12000489936559758295,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,10600028869935865781,13893913993855374336,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,3420860247806594914,16925675032528916014,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
        5⤵
        
        PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9034087583273159480,6912075199233953160,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
        5⤵
        
        PID:220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,3233971447579330679,9259037244225883492,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        5⤵
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,9837804197854923649,9039863723463778476,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4149204828668846063,10211202706233969009,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,16754885570084323452,6978620002547835366,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,13509228309185221794,10160145518390394238,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        5⤵
        
        PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,3066707656258299152,9102081443231729749,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
        5⤵
        
        PID:732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,10978541699979142502,2089340017709863724,524288 --field-trial-handle=2568,i,11375701559497123210,10546169843195864720,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        
        PID:376
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\start.bat"
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\system32\mode.com
      mode con: cols=80 lines=25
      4⤵
      PID:5004
  - - C:\Windows\system32\openfiles.exe
      openfiles
      4⤵
      PID:4352
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "WindowsAIKHash" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 30568-23111-93287-38856-22150 /f >nul 2>&1
        5⤵
        
        PID:3744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 79609-13642-31543-91742-91145 /f >nul 2>&1
        5⤵
        
        PID:2740
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {23903-90234-47339-86025-17771} /f >nul 2>&1
        5⤵
        
        PID:1592
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {86873-54785-84950-60553-67647} /f >nul 2>&1
        5⤵
        
        PID:4036
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {56116-35564-31121-20547-52270} /f >nul 2>&1
        5⤵
        
        PID:3956
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:464
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {92495-41909-79765-32296-42507} /f >nul 2>&1
        5⤵
        
        PID:1808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 86254 /f
        5⤵
        
        PID:2868
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 57283 /f
        5⤵
        
        PID:2548
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 96469-32061-69188-71708-88051 /f
        5⤵
        
        PID:4580
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 66125-57109-18059-45209-77661 /f
        5⤵
        Modifies registry key
        
        PID:3376
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 67370-10652 /f
        5⤵
        Modifies registry key
        
        PID:1680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 39538 /f
        5⤵
        Modifies registry key
        
        PID:2240
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 54924-19719-35334 /f
        5⤵
        
        PID:2808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS75555 /f
        5⤵
        
        PID:2956
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS39283 /f
        5⤵
        Modifies registry key
        
        PID:2472
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 81586 /f
        5⤵
        
        PID:1560
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 96472 /f
        5⤵
        
        PID:4252
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {27990-40487-92996-25470-24145} /f
        5⤵
        
        PID:2424
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {97419-13784-18590-94171-47430} /f
        5⤵
        
        PID:4680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {34226} /f
        5⤵
        Modifies registry key
        
        PID:216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 60097 /f
        5⤵
        
        PID:2564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 71843 /f
        5⤵
        
        PID:432
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 85879 /f
        5⤵
        
        PID:1712
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {33609-69177-28569-36493-60525} /f
        5⤵
        Modifies registry key
        
        PID:2976
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskManufacturerId" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:3676
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 33732-26275-96451-42020-25314 /f >nul 2>&1
        5⤵
        
        PID:5076
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 71556-95589-23490-83689-83092 /f >nul 2>&1
        5⤵
        
        PID:3668
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {10242-76573-33677-72363-94110} /f >nul 2>&1
        5⤵
        
        PID:1648
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {73211-41124-71289-46892-53985} /f >nul 2>&1
        5⤵
        
        PID:1760
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {48063-27511-23068-12494-44217} /f >nul 2>&1
        5⤵
        
        PID:3216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {78306-27721-65576-18107-28318} /f >nul 2>&1
        5⤵
        
        PID:8
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 21852 /f
        5⤵
        
        PID:1560
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 49494 /f
        5⤵
        
        PID:2652
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 26723-52314-89442-91961-18304 /f
        5⤵
        
        PID:4744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 40192-31176-82126-19276-51728 /f
        5⤵
        
        PID:2272
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 86832-30114 /f
        5⤵
        Modifies registry key
        
        PID:3988
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2356
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 15928 /f
        5⤵
        Modifies registry key
        
        PID:1436
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 93535-58331-73945 /f
        5⤵
        
        PID:3372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS62898 /f
        5⤵
        Modifies registry key
        
        PID:2412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS49061 /f
        5⤵
        
        PID:3868
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 42206 /f
        5⤵
        
        PID:548
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 38948 /f
        5⤵
        
        PID:3260
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {26024-38521-91029-23504-22178} /f
        5⤵
        
        PID:1920
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {67146-73511-78318-63898-17157} /f
        5⤵
        Modifies registry key
        
        PID:3080
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2956
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {22361} /f
        5⤵
        
        PID:3256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 15372 /f
        5⤵
        
        PID:1176
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4352
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 82675 /f
        5⤵
        Modifies registry key
        
        PID:2220
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 40363 /f
        5⤵
        
        PID:3184
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {17717-53286-12677-20601-44634} /f
        5⤵
        
        PID:2516
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskInformationFlags" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:800
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 39220-31763-11939-47508-30801 /f >nul 2>&1
        5⤵
        
        PID:2412
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4580
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 98423-32456-50357-20557-19959 /f >nul 2>&1
        5⤵
        
        PID:1680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {88113-64444-21548-60234-81981} /f >nul 2>&1
        5⤵
        
        PID:4632
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {23669-81581-21746-87349-94442} /f >nul 2>&1
        5⤵
        
        PID:852
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {55132-34581-30138-19564-51287} /f >nul 2>&1
        5⤵
        
        PID:812
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {38249-77663-25519-68050-78260} /f >nul 2>&1
        5⤵
        
        PID:4176
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5004
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 18496 /f
        5⤵
        
        PID:4056
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 38947 /f
        5⤵
        
        PID:3744
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4252
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 16176-41767-78895-81415-97757 /f
        5⤵
        
        PID:2220
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 18428-99412-60362-87512-29964 /f
        5⤵
        Modifies registry key
        
        PID:1556
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 42634-75916 /f
        5⤵
        
        PID:3968
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 72997 /f
        5⤵
        Modifies registry key
        
        PID:3328
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 32561-87357-12971 /f
        5⤵
        
        PID:4952
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS86316 /f
        5⤵
        Modifies registry key
        
        PID:4792
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS55125 /f
        5⤵
        Modifies registry key
        
        PID:4872
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 86475 /f
        5⤵
        Modifies registry key
        
        PID:4388
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 56229 /f
        5⤵
        Modifies registry key
        
        PID:5008
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {49968-62465-24974-47448-46123} /f
        5⤵
        
        PID:2212
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {39559-45924-50731-36311-79571} /f
        5⤵
        Modifies registry key
        
        PID:3744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {66894} /f
        5⤵
        
        PID:1048
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 98901 /f
        5⤵
        Modifies registry key
        
        PID:1772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 95354 /f
        5⤵
        
        PID:1552
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1436
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 24471 /f
        5⤵
        
        PID:4988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {73945-19514-68905-76829-10862} /f
        5⤵
        
        PID:4492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\TaskStates" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:3828
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 71959-64502-44678-80247-63541 /f >nul 2>&1
        5⤵
        
        PID:1760
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 13647-37680-55581-25781-25183 /f >nul 2>&1
        5⤵
        
        PID:3392
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {42860-19191-66296-14982-36728} /f >nul 2>&1
        5⤵
        
        PID:1592
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {27574-85487-25652-91255-98348} /f >nul 2>&1
        5⤵
        
        PID:2316
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {94008-73456-69013-58439-90162} /f >nul 2>&1
        5⤵
        
        PID:2564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {45468-84882-32738-75269-85480} /f >nul 2>&1
        5⤵
        
        PID:1348
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 39754 /f
        5⤵
        
        PID:772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 20419 /f
        5⤵
        
        PID:3460
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 81511-17103-54230-56750-73093 /f
        5⤵
        Modifies registry key
        
        PID:4732
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 45559-36543-87493-24643-57095 /f
        5⤵
        
        PID:1232
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 63629-96911 /f
        5⤵
        Modifies registry key
        
        PID:3392
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 49124 /f
        5⤵
        Modifies registry key
        
        PID:4416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 86944-51739-67353 /f
        5⤵
        
        PID:216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS18102 /f
        5⤵
        
        PID:772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS60086 /f
        5⤵
        
        PID:1816
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 34295 /f
        5⤵
        
        PID:1368
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 59344 /f
        5⤵
        Modifies registry key
        
        PID:1760
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {86470-98968-61476-83950-82625} /f
        5⤵
        Modifies registry key
        
        PID:3392
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {27430-33795-38602-24182-67442} /f
        5⤵
        
        PID:4988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {60374} /f
        5⤵
        
        PID:4732
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 92381 /f
        5⤵
        
        PID:1068
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 24816 /f
        5⤵
        
        PID:4216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 49542 /f
        5⤵
        
        PID:2316
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {99016-44584-93976-11900-35933} /f
        5⤵
        
        PID:2988
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\PlatformQuoteKeys" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:1744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 37182-29725-99901-45470-28763 /f >nul 2>&1
        5⤵
        
        PID:4388
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 13049-37082-54983-25182-24585 /f >nul 2>&1
        5⤵
        
        PID:4216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {86075-62406-19510-58196-79943} /f >nul 2>&1
        5⤵
        
        PID:1684
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {71316-39229-69394-44997-52090} /f >nul 2>&1
        5⤵
        
        PID:2988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {57385-36833-32390-21816-53539} /f >nul 2>&1
        5⤵
        
        PID:772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {10427-49841-87697-40228-50439} /f >nul 2>&1
        5⤵
        
        PID:2652
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 10322 /f
        5⤵
        
        PID:4736
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 80986 /f
        5⤵
        
        PID:1556
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2516
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 52079-77671-24798-27318-43660 /f
        5⤵
        
        PID:3068
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 15599-96583-57533-84683-27135 /f
        5⤵
        
        PID:3496
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 22980-56262 /f
        5⤵
        Modifies registry key
        
        PID:3116
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 96892 /f
        5⤵
        
        PID:3096
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 40686-95481-21095 /f
        5⤵
        
        PID:4952
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS72533 /f
        5⤵
        
        PID:2740
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS25045 /f
        5⤵
        
        PID:3612
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 78565 /f
        5⤵
        
        PID:2164
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 12559 /f
        5⤵
        Modifies registry key
        
        PID:3344
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {51429-63927-26435-48910-47584} /f
        5⤵
        
        PID:4660
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {52765-59130-63937-49517-92776} /f
        5⤵
        Modifies registry key
        
        PID:4612
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2976
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {81155} /f
        5⤵
        
        PID:4080
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 34906 /f
        5⤵
        Modifies registry key
        
        PID:4808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 85911 /f
        5⤵
        
        PID:1232
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 20109 /f
        5⤵
        
        PID:3320
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {80800-26369-75761-83684-17717} /f
        5⤵
        
        PID:2212
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4000
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement\EKCertStoreECC\Certificates" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:1920
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 35875-28417-98594-44163-27456 /f >nul 2>&1
        5⤵
        
        PID:216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 96133-30166-48067-18266-17669 /f >nul 2>&1
        5⤵
        
        PID:1592
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {46035-22366-69471-18157-39903} /f >nul 2>&1
        5⤵
        
        PID:3108
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {47048-14960-45125-20728-27821} /f >nul 2>&1
        5⤵
        
        PID:3256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {39252-18700-14257-93683-35406} /f >nul 2>&1
        5⤵
        
        PID:3120
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {80712-30127-67982-20513-30724} /f >nul 2>&1
        5⤵
        
        PID:3744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 70445 /f
        5⤵
        
        PID:4680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 56718 /f
        5⤵
        
        PID:4888
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 34473-60065-97192-99712-26055 /f
        5⤵
        Modifies registry key
        
        PID:3244
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 93075-84059-45009-72159-14611 /f
        5⤵
        
        PID:4180
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 21145-54427 /f
        5⤵
        
        PID:1448
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4464
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 16802 /f
        5⤵
        Modifies registry key
        
        PID:732
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 44987-99782-25396 /f
        5⤵
        
        PID:4416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS82443 /f
        5⤵
        
        PID:4696
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS62997 /f
        5⤵
        Modifies registry key
        
        PID:4732
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 31598 /f
        5⤵
        Modifies registry key
        
        PID:452
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 44902 /f
        5⤵
        Modifies registry key
        
        PID:4780
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {89382-11879-64387-86862-85536} /f
        5⤵
        
        PID:1496
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {79500-85865-90672-76252-29511} /f
        5⤵
        Modifies registry key
        
        PID:4660
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4080
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {23498} /f
        5⤵
        
        PID:636
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 72858 /f
        5⤵
        
        PID:1780
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 17038 /f
        5⤵
        
        PID:4236
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 35627 /f
        5⤵
        
        PID:1648
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {28753-64321-23713-31637-55670} /f
        5⤵
        Modifies registry key
        
        PID:1708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EkRetryLast" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:4416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 28876-21419-91595-37164-20458 /f >nul 2>&1
        5⤵
        
        PID:1960
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2740
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 10352-34385-52286-22485-21887 /f >nul 2>&1
        5⤵
        
        PID:772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {61471-37802-84907-33593-55339} /f >nul 2>&1
        5⤵
        
        PID:3108
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {45658-13570-43735-19338-26431} /f >nul 2>&1
        5⤵
        
        PID:2952
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {37862-17310-12868-92293-34017} /f >nul 2>&1
        5⤵
        
        PID:3372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {13339-52753-90608-43140-53350} /f >nul 2>&1
        5⤵
        
        PID:1408
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 18315 /f
        5⤵
        
        PID:2092
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 27549 /f
        5⤵
        
        PID:2220
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4792
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 88642-24233-61361-63880-80223 /f
        5⤵
        
        PID:3252
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 68987-59971-20921-48071-80523 /f
        5⤵
        
        PID:3460
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 70759-14041 /f
        5⤵
        
        PID:4180
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 61862 /f
        5⤵
        
        PID:3096
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 15291-70086-85700 /f
        5⤵
        Modifies registry key
        
        PID:1708
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS53274 /f
        5⤵
        Modifies registry key
        
        PID:4252
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS16475 /f
        5⤵
        
        PID:3416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 47298 /f
        5⤵
        Modifies registry key
        
        PID:3920
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3116
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 88644 /f
        5⤵
        
        PID:1068
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4872
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {27353-39850-92359-24833-23508} /f
        5⤵
        
        PID:432
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {11863-18228-23034-98615-51874} /f
        5⤵
        
        PID:3864
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2472
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {39198} /f
        5⤵
        
        PID:2368
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:636
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 65596 /f
        5⤵
        Modifies registry key
        
        PID:4452
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 88031 /f
        5⤵
        
        PID:4476
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1780
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 28893 /f
        5⤵
        Modifies registry key
        
        PID:4904
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {89057-34625-84017-91941-25973} /f
        5⤵
        
        PID:3344
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EKPub" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:3988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 72305-64848-45024-80593-63887 /f >nul 2>&1
        5⤵
        
        PID:3836
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4252
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 42563-66596-84497-54697-54099 /f >nul 2>&1
        5⤵
        
        PID:3868
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {93155-69486-26591-65277-87023} /f >nul 2>&1
        5⤵
        
        PID:2968
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {84006-51918-82083-57686-64779} /f >nul 2>&1
        5⤵
        
        PID:3940
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1068
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {99698-79147-74704-64130-95853} /f >nul 2>&1
        5⤵
        
        PID:4780
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4900
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {67985-17399-55254-97786-17996} /f >nul 2>&1
        5⤵
        
        PID:2212
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4612
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 95922 /f
        5⤵
        
        PID:3092
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4428
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 87276 /f
        5⤵
        
        PID:4028
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2092
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 76249-11841-48968-51488-67830 /f
        5⤵
        
        PID:2272
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5008
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 80611-71595-32545-59695-92147 /f
        5⤵
        
        PID:3284
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 59685-92967 /f
        5⤵
        
        PID:4896
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1232
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 59896 /f
        5⤵
        Modifies registry key
        
        PID:5076
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1368
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 92107-56902-72517 /f
        5⤵
        
        PID:4780
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS28874 /f
        5⤵
        Modifies registry key
        
        PID:4248
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3320
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS87683 /f
        5⤵
        
        PID:4216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 97654 /f
        5⤵
        
        PID:3612
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1196
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 71962 /f
        5⤵
        
        PID:532
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4632
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {70782-83279-45788-68262-66937} /f
        5⤵
        
        PID:4112
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {28567-34933-39739-25319-68579} /f
        5⤵
        Modifies registry key
        
        PID:3868
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {72728} /f
        5⤵
        
        PID:2272
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 59076 /f
        5⤵
        
        PID:4180
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1964
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 20081 /f
        5⤵
        
        PID:4744
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 78985 /f
        5⤵
        
        PID:3328
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4952
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {96126-41695-96695-14619-38652} /f
        5⤵
        
        PID:3096
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\delete.bat"
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - Modifies registry class
    PID:812
  - - C:\Windows\system32\mode.com
      mode con: cols=80 lines=20
      4⤵
      PID:2472
  - - C:\Windows\system32\openfiles.exe
      openfiles
      4⤵
      PID:452
  - - C:\Windows\system32\sc.exe
      sc stop winveralt
      4⤵
      Launches sc.exe
      PID:2516
  - - C:\Windows\system32\sc.exe
      sc delete winveralt
      4⤵
      Launches sc.exe
      PID:2620
  - - C:\Windows\system32\sc.exe
      sc stop winverred
      4⤵
      Launches sc.exe
      PID:772
  - - C:\Windows\system32\sc.exe
      sc delete winverred
      4⤵
      Launches sc.exe
      PID:1780
  - - C:\Windows\system32\sc.exe
      sc stop winverseri
      4⤵
      Launches sc.exe
      PID:3460
  - - C:\Windows\system32\sc.exe
      sc delete winverseri
      4⤵
      Launches sc.exe
      PID:3420
  - - C:\Windows\system32\sc.exe
      sc stop vcsass
      4⤵
      Launches sc.exe
      PID:4632
  - - C:\Windows\system32\sc.exe
      sc delete vcsass
      4⤵
      Launches sc.exe
      PID:4904
  - - C:\Windows\system32\attrib.exe
      attrib -s -h "C:\Windows\System32\winveralt.sys"
      4⤵
      Views/modifies file attributes
      PID:4000
  - - C:\Windows\system32\attrib.exe
      attrib -s -h "C:\Windows\System32\winverred.sys"
      4⤵
      Views/modifies file attributes
      PID:4388
  - - C:\Windows\system32\attrib.exe
      attrib -s -h "C:\Windows\System32\winverseri.sys"
      4⤵
      Views/modifies file attributes
      PID:3500
  - - C:\Windows\system32\attrib.exe
      attrib -s -h "C:\Windows\System32\vcsass.sys"
      4⤵
      Views/modifies file attributes
      PID:4216
  - - C:\Windows\system32\attrib.exe
      attrib -s -h "C:\Windows\System32\c.vbs"
      4⤵
      Views/modifies file attributes
      PID:2740
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "cvbs" /f
      4⤵
      PID:4744
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKLM\SYSTEM\CurrentControlSet\Services\winveralt" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:1704
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 67405-59948-40124-75693-58987 /f >nul 2>&1
        5⤵
        
        PID:1496
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 43272-67305-85206-55405-54808 /f >nul 2>&1
        5⤵
        
        PID:1068
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {77566-53897-11001-49687-71434} /f >nul 2>&1
        5⤵
        
        PID:1064
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {52645-20557-50722-26325-33419} /f >nul 2>&1
        5⤵
        
        PID:2520
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {27496-96945-92502-81927-23651} /f >nul 2>&1
        5⤵
        
        PID:1964
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {75093-24507-62363-14894-25104} /f >nul 2>&1
        5⤵
        
        PID:416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 74460 /f
        5⤵
        
        PID:4492
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 77031 /f
        5⤵
        
        PID:3500
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 71613-97204-44332-46852-63194 /f
        5⤵
        Modifies registry key
        
        PID:4696
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 64757-55741-16691-43842-76293 /f
        5⤵
        
        PID:2272
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 77219-20501 /f
        5⤵
        
        PID:3460
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 61659 /f
        5⤵
        
        PID:3260
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 88262-53057-68672 /f
        5⤵
        
        PID:4464
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS35191 /f
        5⤵
        Modifies registry key
        
        PID:5056
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS88919 /f
        5⤵
        
        PID:1592
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 46831 /f
        5⤵
        
        PID:416
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 72934 /f
        5⤵
        
        PID:376
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {26886-39383-91892-24366-23041} /f
        5⤵
        
        PID:2652
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {96315-12680-17486-93067-46326} /f
        5⤵
        
        PID:2472
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {21905} /f
        5⤵
        
        PID:216
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1176
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 81427 /f
        5⤵
        
        PID:4476
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 26134 /f
        5⤵
        Modifies registry key
        
        PID:3284
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 39643 /f
        5⤵
        Modifies registry key
        
        PID:4872
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {95780-41349-90740-98664-32697} /f
        5⤵
        Modifies registry key
        
        PID:1368
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKLM\SYSTEM\CurrentControlSet\Services\winverred" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:1772
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 49717-42260-22436-58005-41299 /f >nul 2>&1
        5⤵
        
        PID:3612
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 92095-26128-44029-14228-13631 /f >nul 2>&1
        5⤵
        
        PID:4236
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {53742-30073-77178-25864-47610} /f >nul 2>&1
        5⤵
        
        PID:852
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {21631-79543-19708-85311-92404} /f >nul 2>&1
        5⤵
        
        PID:1648
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {88064-67512-63070-52495-84219} /f >nul 2>&1
        5⤵
        
        PID:8
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {50742-90156-38011-80543-90753} /f >nul 2>&1
        5⤵
        
        PID:4888
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5056
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 50636 /f
        5⤵
        
        PID:3868
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 30773 /f
        5⤵
        
        PID:2088
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 81176-16768-53895-56415-72758 /f
        5⤵
        
        PID:4488
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:376
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 50832-41816-92766-29916-62368 /f
        5⤵
        Modifies registry key
        
        PID:1648
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 74511-17793 /f
        5⤵
        Modifies registry key
        
        PID:4580
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4056
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 76831 /f
        5⤵
        
        PID:1048
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 19570-74365-89980 /f
        5⤵
        
        PID:1960
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS68243 /f
        5⤵
        
        PID:548
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS25308 /f
        5⤵
        
        PID:3256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 90573 /f
        5⤵
        
        PID:2520
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 47528 /f
        5⤵
        
        PID:2412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {19970-32467-84976-17450-16125} /f
        5⤵
        Modifies registry key
        
        PID:2424
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2316
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {16224-22589-27396-12976-56236} /f
        5⤵
        Modifies registry key
        
        PID:1196
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {54249} /f
        5⤵
        
        PID:2988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 91337 /f
        5⤵
        
        PID:5084
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 29908 /f
        5⤵
        
        PID:4388
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1064
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 55161 /f
        5⤵
        
        PID:5076
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {15690-51259-10650-18574-42607} /f
        5⤵
        Modifies registry key
        
        PID:4416
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKLM\SYSTEM\CurrentControlSet\Services\winverseri" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:4132
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 37193-29736-99912-45481-28774 /f >nul 2>&1
        5⤵
        
        PID:3092
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 73962-97995-25896-86096-85498 /f >nul 2>&1
        5⤵
        
        PID:548
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {35082-11413-58517-97203-28950} /f >nul 2>&1
        5⤵
        
        PID:3184
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {14715-72627-12792-78395-85488} /f >nul 2>&1
        5⤵
        
        PID:2092
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {90783-70231-65789-55214-86938} /f >nul 2>&1
        5⤵
        
        PID:3420
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {43826-83240-31095-73627-83837} /f >nul 2>&1
        5⤵
        
        PID:1012
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 37585 /f
        5⤵
        
        PID:4808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 24385 /f
        5⤵
        
        PID:852
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 91086-26678-63805-66325-82667 /f
        5⤵
        
        PID:3320
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 60215-51199-12149-39299-71750 /f
        5⤵
        
        PID:8
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5076
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 11246-44528 /f
        5⤵
        
        PID:4428
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 92349 /f
        5⤵
        
        PID:4216
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 34561-89356-14970 /f
        5⤵
        
        PID:2108
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS89370 /f
        5⤵
        
        PID:3920
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:852
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS46435 /f
        5⤵
        
        PID:3500
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 38525 /f
        5⤵
        Modifies registry key
        
        PID:1408
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1760
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 68655 /f
        5⤵
        
        PID:2092
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {24189-36686-89195-21669-20344} /f
        5⤵
        
        PID:2496
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1012
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {26051-32417-37223-22803-66063} /f
        5⤵
        Modifies registry key
        
        PID:2164
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {58468} /f
        5⤵
        
        PID:4136
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 27990 /f
        5⤵
        
        PID:4872
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 68305 /f
        5⤵
        
        PID:4900
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 15830 /f
        5⤵
        Modifies registry key
        
        PID:2736
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {87211-32780-82171-90095-24128} /f
        5⤵
        
        PID:3968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_3932\reg.vbs" delete "HKLM\SYSTEM\CurrentControlSet\Services\vcsass" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:4396
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 40621-33163-13340-48909-32202 /f >nul 2>&1
        5⤵
        
        PID:1680
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:452
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 10879-34912-52813-23012-22415 /f >nul 2>&1
        5⤵
        
        PID:1348
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2620
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {61998-38329-85434-34120-55866} /f >nul 2>&1
        5⤵
        
        PID:860
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {42686-10598-40763-16366-23460} /f >nul 2>&1
        5⤵
        
        PID:3260
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {29282-98730-94287-83713-25436} /f >nul 2>&1
        5⤵
        
        PID:4428
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2736
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {93176-42591-80446-32977-43188} /f >nul 2>&1
        5⤵
        
        PID:4988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 64237 /f
        5⤵
        
        PID:4896
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 50510 /f
        5⤵
        
        PID:4744
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 23712-49304-86431-88951-15294 /f
        5⤵
        
        PID:4780
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 83368-74352-35302-62452-94904 /f
        5⤵
        Modifies registry key
        
        PID:2564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 84613-27895 /f
        5⤵
        Modifies registry key
        
        PID:688
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3496
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 73607 /f
        5⤵
        
        PID:3244
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 88993-53788-69402 /f
        5⤵
        Modifies registry key
        
        PID:4808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS42585 /f
        5⤵
        Modifies registry key
        
        PID:548
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2108
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS95786 /f
        5⤵
        Modifies registry key
        
        PID:2952
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 32796 /f
        5⤵
        
        PID:5084
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3184
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 57317 /f
        5⤵
        Modifies registry key
        
        PID:464
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3260
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {17405-29902-82411-14885-13560} /f
        5⤵
        
        PID:1592
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:688
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {12604-18969-23776-99356-52616} /f
        5⤵
        
        PID:3700
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1556
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {50629} /f
        5⤵
        
        PID:4896
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4492
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 99989 /f
        5⤵
        
        PID:4488
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3120
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 73793 /f
        5⤵
        Modifies registry key
        
        PID:1256
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 99046 /f
        5⤵
        Modifies registry key
        
        PID:732
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {86035-31604-80996-88919-22952} /f
        5⤵
        
        PID:3540
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3968
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3656_1315906286\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a11ee32809b8e8b56be7f9a4ca5947b98247ae9705decaf6d90b1e3bc36b5802
MD5 ec17535594c93c4d00aef3f348077bcd
SHA1 d11953fe2a8a114823b67b9aab58874d9b7d4509
SHA512 223d37fc3d0226dcf737343045370b79a1dbe39d1b07a3f1a5aa30a084d2a60fa091b8f852e01dca3f0d889b737c66cedb29e4df82544c59c5df162ff4ee8082
SSDEEP 192:qznO8MMMR9TPPpEud9YaXLdtqtzLzmBtapzGP6zddTrVoj17ojzU/ImaAVGmb02t:qaqA9LB/4nzGOwcR2eo/ImDGqs
TLSH
T13F13F93E7A452C46F2C7643E03AB2A362331D179D4E045B3EB35F416471AB62B92EB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4c428a5964dadf8571474f4487656c13f354e66c307be2e42b21faa1c66f12d5
MD5 ab64af7dbe7c774a842c6991ab9cb1ed
SHA1 fc507c9d5bbb4abda04c19f6b09c52ecb9da72af
SHA512 1849735debfbdd460df79b54b26a64694fc836dd462eda8f6cd72b299ed00f7a8fb36cc2db8a328c786fa9216fdb787f5bcb7262cd9bbc3c743cf2cde1ed15b3
SSDEEP 1536:KazgQL/uyL/f92c8cZYcmGp/VK9EL/yL/GL/d0tj:K8gQL/RL/hHL/yL/GL/
TLSH
T127445EF71941A00BDBA852F5E6033A3EC177491D7CE1E8A9D678AC811C35B72B6FCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8611a44ce8de67b56d8666092f2f9cd9f49b1f21d85b6e7919b65bbe1b9837c7
MD5 64f1f28f25fe14a310939d3439ea7c13
SHA1 8ad87489d6986451c1ea1591ecd55968d1edf1de
SHA512 71b9b6e5481bf951840f0d194e19ae1a28c08db625f70587e10f4b739fcb65607792e826b6b8def1fb321176250f05c6d76189aa07054ee48aff90eda9462fcc
SSDEEP 3072:IW3nYtuJv2k+HprFKN1WWfQemfoulMcKhUPhD9JeZpz3:OtuJv/kxKN1jYe0HMcKhYV9JeZ
TLSH
T187254DDECB282C43CFA78B71B4D0D8073EB421C2BA99D0D39441C5E966D2BC576E926D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 fd31cec6763b1bc1cd119221dc1b3e5278cbf5585569fa34b0b810d42a4b9fdc
MD5 254793f0ca5e0efa7477d93312b37608
SHA1 0967b4a26dda9c0cf2205f0c37b7f3cba5b42152
SHA512 5588ced64712d315b85a56ad1f44724969f7ca92b17cac201788150cdcb3880d02129f379c7b5f645f26a09b3cf095759fe1d0d6b61be6455f209ffa08fa7a06
SSDEEP 24576:bOvTvdFIWNY1wrOLm0e9ZmjHGVqSKHwCJfA2rwEg:av7tNY1vm0e9GaqSMw8Vr
TLSH
T195167DEDCA6858C3DD639A30B4F0E9477C7413C3F955C1E68C98C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cb973eb84c4a7e4830d26c9051d975e3f75140220ea2963bfcc6ae67f2e559c0
MD5 1427db689942f9eaf0cb327c620ee79f
SHA1 30172fd5a51991f771cd4742654579a6765585ce
SHA512 50ed7bab5e6cb7a52c47c813888bd336c564b7bf6d67978c2f07d4655929d970fb74995a387618a7bf73c2bd784ce69fa7f36a524c4f0b2328b5f63a7e0c902b
TLSH
T1A781834112F14019F7D8F033D7D80777BA313D7A2E639E39A1A6F6789872365B528A83
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d6f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d6f2.TMP
Size 3KB
SHA256 2b59e544681e10c558309d2588b54811848714749ea30cdcb99b2418915b06f5
MD5 c09ed9e88a39eff0faa4bfe0f8ce0cbb
SHA1 eaef4212bd0d801f7c7f61ff9d9f7d24069af207
SHA512 c1a499acc0edd3e32cd7c6b14244cc94243f467e2e2d23fc9dcbc6e511e0c0e92da359c801a245b2023e3f6a842aeb2e4438b4a7d097584ece111cec41951d00
TLSH
T1CF61974556F08159F7987072D7D803B7B7307CB23AB79E32A1A8F57898663797128083
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 0e7e34e672a7c617e037671f901809fb76aa4622eeea000b7f2c0db122378a14
MD5 22777ef2ca85e84de239d28b9121bf8d
SHA1 292235678a3ee3a62cc62db4b55a157472e55b1e
SHA512 07af5d895ec5a815593970cb08c17da114923915267a8db9460419dda6dc8de3ef32bdd63fe88f5969e3646f7e598280cf77edcb1e3c6b955a560bec56a8f0c4
TLSH
T17CE0DFD6A7CAC22E66703AD241346F8882A03643E69DEE0B17008CC47A03411BFA268A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 71cdb9891b51231d89ace75a69882a7e9daac526d7335a2e4f5f64aa27303d69
MD5 6ba31433a8d2c1bd7c5dda15268d89e2
SHA1 f827614548ceb5f8b63109b781c3e9e6991d3442
SHA512 b0b75c5b9d642c3b10e3d58d023d3400c5bdaa003ad31e80a147e055423d9350b9e865dce7e524b5ef53990a528cdd3e48f3709e4be1b0467b6295792a2dc5a6
TLSH
T184E0268454C8C939916478D38278A788C7E0B503B28C3B0E5748E885B142241E3AABC0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 34a9e148ff5c1b320ec5343b4149dbc81c8d9dd15f7342c86fd259c9e5c28e29
MD5 b87e91517ebb528c3a2473c446005350
SHA1 d889c33e3d03b2e0230e61583b5c6bd7cf6c5f54
SHA512 c98732d644a5a82b9600e8c4fbffe445ccfed7547dbd5067a192f1b9d71fc21c8f206e27e7e8944c902d41cfcdd163af13df6d3e8ab6e4956bc019955ac5c29f
SSDEEP 96:n4JwwIU+bGz83uy3+u4tgp4DLjGQLBze9z33jBHMsDEuspU0wbtqrOQpPfR4J+Mk:n4zf+G83uy3Ct7XBBKxH7DXspU3iD
TLSH
T1DB14220E5F343721CDBD517669E744B35D6CF03F8B5266DA686104B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 112B
SHA256 c493f4c38c0593f015315dd93480a416fe948aca5deebadea72044fb3b0d2ee6
MD5 8f654320b97d22ec2e8cd18e4aaefaa5
SHA1 1707e870419f2ad63b020a569b656bbc7bc71c9c
SHA512 601ad9be23ef76860acde489f39095a8f7753f98535fd956d0eb4a180cb6bbb9760209f645358d866bd2881b6cac9521f16867200e5f9610259ad3fabfb5e336
TLSH
T1CCB092EB6D0F0C43F78004F03C533368D61E101EAEA4D288C840640014210B811F8910
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 58d6be828dea7fbbe88be051ed7f9cdcea87075fed72aba0bee6fdc1faef4826
MD5 8bc7439a39e26bc9710ff2e7b92c47b5
SHA1 56c569c20e7e00a1df537c0f4b6c7037f1994965
SHA512 57fb4dda143a3ee8bcd024cbc2b0d9d51861a62f2c15e6a8ed9cafb845bc456a3b1e3cb601c24a4f99679d0eafa589543f8e5183c6d5d626a593cb20d8c1a820
TLSH
T10AE026A468DDC17E7368359B823DBB4CC7B03A07F78C3F0A1B059A45F04A004A3E62C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 486650b263804de5c6c04bfb86290e277649dd7f63dbf3edcc69bd4bf8bbe374
MD5 666794ab5bd9a15ab54ec5bd1e2d4fd2
SHA1 c6bcb5cea58c136c10a2a783125f707a0422f357
SHA512 e10dbfad80c34235b9f08a51a1d6436e824299667c2628817ea682337e279c4fa881070518d788037fbea1f5baa838be829f5eb484c277a7039aa682a200f073
SSDEEP 48:TtLopFMatSaw/auUOt8Bx+HNIX/6ehh6oXw6zsGb6uuhI9GLowG5v:9eMatUaAKxlX//hhfXYgOIQLoB
TLSH
T1D392954E1F306102C0F24B76EBD248272E3C12AA836355BEC95124F38CF12EBF46656A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0c83f95769b2e9327f7dcfc8c93ce9926dd633c3cacc8c62bdfb589492e74749
MD5 01aac89df4361df23e7785a264308bc4
SHA1 8ba3c22ed67dabe38eee8d7d33fabcc9ae68f67f
SHA512 7061ef08fd333c9c566ff7e824118d87c9c71ac3e8924405d86e829ebf98b6ae901e71f5975d5b91f6129eb3a1be64ba5f09f1b4c15a83fa5cfe188dce19139c
TLSH
T1B0618EF7C3E9866E991152F4EA143E1BCE1D0915532C3D4AC4E49E1F9BF28B1D180A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4517fb841ff0de842caf1439dd7c415656072076eb537f669a562fb0d724a9d7
MD5 7c8cf8ff88dd7f32c402d88ec9919651
SHA1 e88cb98395e412fa377969aa71b7664956e2fc3f
SHA512 1d2d8d4d43fd700c5a63a107e6a171487d1d3941edb16c177f1bae991d2ff1fc943a23d73627d81b4b6dd1df812a50ec70300718b4d58f7db936994da12c4aa5
TLSH
T177519CF7C3A9867E9A0152F5EA143E1BCE190505432C7D06C5E49E1BABF28B1E140A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c851bff98bbfdcb2f205001f5757f02d3ec123690b1193c2bac0bcd186b8ff0
MD5 f1a8b5a75b6b3905f424aef47d6a986b
SHA1 aaf77cd5a426b7fd5cce6e6fb586c90cd01f97fa
SHA512 fcc63bdaed14f3e8f04331772932cb241eb2422474e8c5fe0ea06755437e6acd34c1678048c48d5244099eda070ae2ca3926ad2b104402b42a965d2878b1ae8c
TLSH
T16241ACF7C3E8867E9A0152F5EA142E1BCE180515432C7D06C5E49E1FABF28F1E180A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 eaaa655f1e5c3eadb07706988859ec2c2457244c63708108aa9c899247cbe244
MD5 6ef9cf47f3190ff2730f11dc52a769ce
SHA1 c02c2112dd9a405ce4567cf424c1ac5f5a4db79e
SHA512 9ab79fb9a77a1d3d980f717a3772186a088dadf93d68712bda7a8257836b5545c9a8dded2399d16f509f33a0bce0e2569020b4c6cbb8c44ade28929584363770
SSDEEP 192:OIEumQv8m1ccnvSO0pfDFGipfD1KwgDfY:nptWflf8i
TLSH
T1D7F2F0F617376506D98444F0E000AF9FAF06004B42B6B6EC66C447E3F7A24E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 728e78cbb63d9a7383ea73421876fe8ca1abae1887b3632a78ae34efcce2ad3a
MD5 d1dc92d27834dc7f4b5430a319457517
SHA1 8f00fd07bd502025899116c28f9ffc1904b41141
SHA512 50dedbcc15ff3f917a72248ca732523195a49501e5e143fb93bb1f4123aa649883ae8b3a9f0c9bf06ce06928a8828d36f40e3742cf28b53f586fcbcde7c990f0
TLSH
T163F09ED2C1BFE47B20AE5D7A1D543846BA3BE8354C4258F5DDA2432CB0D29F72A52832
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bcc119acefa383ef5daba8501b49a5f1fefb26664093d3ef3b37aad4b3e327e
MD5 66bfffe44c27d01c82ed28c6745e2399
SHA1 090cd8b59b51b79e797909d5ec47b699a5ac7cff
SHA512 9577c722374923954964a284e536feeec56d27e50b9388f11c873a21a7f04325a232ddb4f2a50cf0d643d75f66638ccd7f148352978d320dd496c7823bcdb9a6
SSDEEP 192:sxZ6RWZb/fqsPWpV+XEdpxlHW6+WNiUe7/eBSRrY4r6IgEJ:sxZ6Ub/fqsPWv+U3HbE/eMGI
TLSH
T1A132B856BE38687B8CD7D31DFA25BF53D2F9102295D15E94AAFC861C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 841fb9799f6a7f9d0f2d4f71a8131aa356e0b1db1c592ac95ad2e5c2fc302e8b
MD5 2a80fde55f4997fa14eafea9c03b8a0d
SHA1 71fc689616724c93e5b42eb3af5c7ba5c8f0b852
SHA512 f2d9daad676cb52a7550f76a49b8aefb21387b4d1d7118542bebb61d9dbb043842a740b3228138e02b7c33404a68b7f273a5e209c0b5a21a7dacede32d29054c
SSDEEP 192:sxZ6RWZb/fqsUWpVcOYEdpxlHW6+WNiUe7/eBSRrZ4yoIgyJ:sxZ6Ub/fqsUWvci3HbE/elBO
TLSH
T13F32A616BE38A93B8CD6D31DFA55BF53D6F9102251D15E94AAFC8A1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5d039cb1a5365d898d74174339bc8b8f11abf9642e2ab47094df917d26e0c98
MD5 6ebbae45895f1d2932909f8a6ab6eb4c
SHA1 c393aed30b740c73c8845c34cb4e508403e67976
SHA512 cc08bcc5571517ae49b2d3a73f5091078d4652a451da9f8726b3d82b8daf03122d52247c2070930db1ab0e2eb99db3c171e4b2d586b219f59080cd4b7314acf8
SSDEEP 192:sxZ6RWZb/fqsOWpVgOYEdpxlHW6+WNiUe7/eBSRrr04yoIgkJ:sxZ6Ub/fqsOWvgi3HbE/ewJBo
TLSH
T10542B616BD28A93B8CD6D31DFA55BF93D7F9102350D11E94AAFC8A1C10E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 382d2ad57e7b1997e2fa3fe59d41834871e122e3d8036bea79e70270f433ffbc
MD5 41f48a712cd2948deeeb3e26770aa392
SHA1 47c1609a6b7e5e74d26aab7f606cfc2b10d01162
SHA512 deec577048890074e82b87e3e8c1bb3277cae04636709824aaf54cf602a055a06ce0f672e422ce4a81b25347cd93bacc08451b10be91a1f8a0c921beb70ef809
SSDEEP 192:sxZ6RWZb/fqsOWpVcOYEdpxlHW6+WNiUe7/eBSRrZ4yoIgyJ:sxZ6Ub/fqsOWvci3HbE/elBO
TLSH
T14342A756BE38A93B8CD6D31DFA55BF93D7F9102251D15E94AAFC8A1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 993692ea89ed9a3cdf41cd03ad3e46243b179afbe3fee333b35578682cbe65dd
MD5 41d8262440831429c25f820455ec6045
SHA1 852ccb88c045060975d16a88118c24ff2979c100
SHA512 d087a2f2381b4610abab97ff3786cd699226bf24d0a8d045acbe2dfe2e8f50bfb5a8ab968daeb04f131a9be22b8783e2a1029780d4accc170d2d1764a9c70357
SSDEEP 768:n4y4JgDWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFiLlc2TbIroRqHUj:n4y4JgDWvbtBhu1jayiLm0bzE0j
TLSH
T118C20A3F644CCA7E4FC00A9DED5E6F9B3E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 0e7bc7c32617222eaf6657fcec3cab9a9e91d225265ef89bec022743521485dd
MD5 730d62c5ff82326d64fe44b36d7cd423
SHA1 5f97b525f2630c7f2ada8f6585cea1aa8ac72e79
SHA512 48e3d30032d69d2e875689a0ca0171d1dc88fe58d69193a2e1e3e28d960222e71a9679396500a4e9241dd12a0be84af276dff5938182e83d742b03fe3f9c0bc2
TLSH
T197E07DD41ECAD17D616530C302349748C3E4B907E2CC3E0A6F80DA85A5C7504F9B71C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 82eabe3683a188d2edbe47b81582da0ae0144903f6a24753ad7f3266809013f4
MD5 6a23f6e32ba4b72f79ab629d1fd02fec
SHA1 d09bdb4031c9b5fd96af93f7dc4f30da0d2d57ab
SHA512 f93f025ff023597bc1d713d5e9f70f6e82837a28cba0187b7eefc01b4d9e6ea41dde64a2498b5b8578589328b713177d2f30843761b8df3cc9ed00d551dee217
TLSH
T187E0D86029DEC63AA29930874264EB48C3A2B513E6CD6E292B08D9C9A20B140F2571C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 61c930d226982eda21d52d56eb143e31453b438044838f051f23f14b4c8f6d0f
MD5 daca3fa3f2bc973bbc51e1a33f5c5c09
SHA1 a0b8426e54b406d16f8b70bc54b62ed9b8d09c73
SHA512 242b62dbde1969fbcc0d51e43c2f65e44b95b825828cb5188b30fea1181d62f35bba8c5dea6046e4adacf9f1d47feeacbb23fd8e84a37725cc4c561c2754cbf8
TLSH
T1AEE026F16DCAC63D5252B0834278BB4C82F1BA17A3CC3B0F57084884A143201F3BB1C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dcd8b3462b9dc8275eea9f8614410cd142c52950bb4017df4e70d6c56e50f391
MD5 f8304e6b77d6247a15b84d5fdf87f1ac
SHA1 7fccf3dca6c8c56b3e4b6db5359f64c0e84fd8ec
SHA512 116aa1553d4c01d33f41fa3bb95d94436a40871bcbf061829f786147298f3149015a69338ed36ace3300e2c9ed5d54b1bc2ffe1144968a1dddcb0bc92a1f3502
SSDEEP 96:KIDCKs0+eLGKYk6WViK2MR/+KEMYm/GKMEV:E5RFBL3p4
TLSH
T115D132D571BB120138BD28488174CF2F564272B73518EA6FBBBC04A29E6BE095DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 81a240666c8424764dcb6ecf581c6c43cf20ee0228c1641c68fb3ff3576e0d06
MD5 025f0d71d21cd3d0c997db5ec6e9b2f0
SHA1 86d1b1a11ccdf7502093ecddcab5b20c8cb30c1e
SHA512 ce85d89f5376c256d9018fca868824a2f985eb394486a7192dc15bc1046b77644305e468b32bde7f568205d045ce0187d5c54c188cab618a7f1ed347716217a3
SSDEEP 96:KIDCKs0+eLGKYk6WViK2MR/+KEMYm/GKMEmGIK/aqg:E5RFBL3psng
TLSH
T150F136D971BB521138BD28488174CF1F5A5231B33518EA6FBBBC04629E6BE085DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8373e202d906b5a2ae673466a9399779aec2f1f693a6bca7497cde785dfefa20
MD5 d1f7ea516ecf94f81295af9798fe48fb
SHA1 ab4c0ab1c5fa5992d35bb756b197c562fb84ecf3
SHA512 dbbc635a142f2e739bcd999e94db749cdf9ada7c0da66cf4884b385fdde4db583bf0fcfb52f23b55b5f06612dec65eaab3ae1f78bf448d82447e44b322d21b41
SSDEEP 192:P+xWPO7EfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxKfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B324630A7B747001EDE6D9725CB080771A3C71ADCF22A6915DB254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 70931682717ef84d5ac4b847c6a166d2c668b0147b9925ac45a101192e973f4f
MD5 3608cdc3453581c6d81751f7a86e10b8
SHA1 48f7dc1267626ed26b65fe721ccfda5e95c1e661
SHA512 1fea6c924c5eb2bb08de7b4ab7ceb2f67571bbbd861bab48ce043627d2d8b2d879a0db6202a6034b678c3033ea1fe06b471319775118755eea534192ff044cc5
TLSH
T1E13162C1F3D960997EC9B841C12E6A07A8A53E3B160D9E75632D48F59F4881C0E3FE61
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 59a62b2bde54454e664370388380f12a6b03239411966a5f03958218adba4af7
MD5 6279c23619b243e77aa03f1e8d3bfd57
SHA1 b0ba4cc44e0e8848840e89bedd72f817e3da3a2b
SHA512 8d93fa0d97803f6abaf3b9c247e670add60bb47b12d5f2b529b7c4b01f7765f00d247018fe443cf49721fcc14be4e36a3a87494d7f160d7bbd0ed71e4d6372b5
TLSH
T133E08690FDDACA7EB1A430870174578CD7917A07FA8C3A4E9F05D889A502154B6AA9D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 610B
SHA256 d15504789905459c9adadfffc70b4b7870c956383aa69fa3e11ecbe4ff0cf525
MD5 8b52f6833903992a5d766ce288f9aae0
SHA1 0889600973b9451c5c397a3d1705fc46930f13fe
SHA512 6ff78f39c9eaaf67b7ce577bb2500888e67df6882169801d28ee791535b9a1ca86f193df0b1f2712193aa43d53735a0ce08fafb10c2e4fc4d7337cc4c79a19ea
TLSH
T17BF03012F328C044D04E823EA42BE7266339D8179FF9DD0F453974251EB6B141E8B7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 3f243efa51f259e5a956c2501112209808c5030b6f18e81f728adfe25be5051a
MD5 19d6f99337f05994fba316fe5adfc4b6
SHA1 eb3de88697f13314193c82fce09b548c4aa0babb
SHA512 526f8e85a1378c3004079a9151de6e35bf7d76226ae93635bc4c231418a887bb56bd5b2be9c6b8acd92512d4971311b47aeab56811fd244558f488b5f302fa35
TLSH
T1FDE0DF90B9CAC9AF91A030830175A7C8C2A1B903FE8C3F0A5F20CA89A143141B2AA981
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c7f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c7f9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bbb7acbf49874a33d873a61868bdd2f29500f62f67c9a1dd3117f0f8653ff33d
MD5 b66901dd7b53cfe76ac6e3a2fbc25273
SHA1 23ddab063f3ae18a023ed0c2f70f059dc9a68c6f
SHA512 a687bb891c7a9990272a01c502fb0d58621302d00aba4d0f5a83b0fa8d271a874fb09a45e808f7c3daa2058aa91442a9fea3284c431f724ef3cbad33fd5ed001
SSDEEP 384:nxZcIhsNFK8iPzZHGMCHX58ED8vD38Ab9DIM+F7IzpoO:Zh7FzAMkaXj5b9DIM9t
TLSH
T122925D75AC346CE784F2E9C5B5456A03AFF8417BD1895E58C1F8A73E209F6B80303932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2135e81b6df488de1032193d4a651519968012cf9b1caa68101c747cbff2fb0f
MD5 36c6aeb8716455b65cf6762315c30667
SHA1 9cf6f100ce5add14b237674c0f9378d2e8cfd490
SHA512 23019d9d7fce6726d0cd81e73ef9f2a0aafc3185de74782ca169d9d40c7753fd8e4bb9428f6849e0e267d6f41909de5dafc936c82eb267c3b8964c669f48e57c
SSDEEP 192:1ONV6wlDgQmiUyu+W4X58gZTjzor22DleDU6:1ONV6kg8W4X58ED8x0U6
TLSH
T12502D934B9787C6B8EF3AD09F48626139FE4112BE6556F40CAEC5A2D00DB69C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 772bb47806c7d1c78b878f20c205b294b2101a62f85922dada44dce926d68159
MD5 7415a84da9671727b51a94da2bb0165d
SHA1 e519b6d43a2c4e31fcc07374f7b2da235bdbf3c6
SHA512 0903f7612de468cf244a7a0d05c997828d6cfd8ad37b2dc6697a106b4b9dc4c4c52a83a6af1432cc1d71e2cbc84141e73ceaa4985a97fcebd8cfff2228c8a4ea
SSDEEP 384:zDsN8XiPzZHLFTHX58ED8pXR+2/8EJASr07oMkLEXMW:nszdF7a5Rl0bStMkLEXMW
TLSH
T109722A74E8A5ACE784E2E0C5A146F643AFE81077C5491F4CD2F8BB3D309F2B81756926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e7a5c3fd0f1776d08211617725dd891e0328ed810b8e7cc7499b6af60e56545a
MD5 4d7b8ff2a7897a26ab5612cd81842737
SHA1 afc7890d2491fd05b5b0c1abaa025c3dba5aab6f
SHA512 1a25d4d27006662aa295179d607b0eedad598415bcde4dac169a6706e23ab0d01b09560bf41b548c8646b585fa96112c7fc6932a159e055a4db1c81cbe781114
SSDEEP 384:zDsN8XiPzZH2FTHX58ED8pXR+2/8EJASr07oMkLEXMW:nszcF7a5Rl0bStMkLEXMW
TLSH
T1B0722974E8A4ACE784E2E0C5A146F653AFE81077C5491F4CD2F8BB3D309F2B81756926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f184f63d512dc36e30d710e3609dd538686f8a1c5e4419f36d2edd5d8869b0eb
MD5 60a569ad5b05043abcf0d53ee4bfa210
SHA1 528ee9035919201ceb75382356da9b79b583dac1
SHA512 bc9c58046c085cf19edf35425ccce4c691d2986dc9c72a99de8d12b8247b98353444353294bc3d0522a816097209e2b969c4f89c71c6c6ea8e918d97ae810ef2
SSDEEP 384:zDsNEXiPzZH2ITHX58ED8pXR+2/+DXM+F7Izw:nczcI7a5RlGDXMk
TLSH
T1C1422A35BD78AC6799F39A05F15A3A43DFF8216BC6851F90DAE84B1E00C639C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 637de79b7fb7972aa4b77cb98fd1dc205ce5e233df00b47891eaaa11194100b3
MD5 d613add37e59206dc35d58689686cfb5
SHA1 bfb6b00ee3e014b498feefca597b2d4e60bd0686
SHA512 295aa4ffbff63a4c691a8fdcba8a6fe1bae8159a1ae10dd8fbf3476ff315b59dacf0bd364bde9aec179ccf8e6d95ab4583eccca2de8236cf32548535b13009cb
SSDEEP 384:nOZcIhsNEj8iPzZHGMCHX58ED8pXR+2/4DXM+F7IzpoO:shjFzAMka5RlQDXM9t
TLSH
T10C826C75AC74AC7798F3E605F1563A43DFF85067D2895F90C6E89B1E00862A91307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 428c616a3490e95c519630a2792f906c2708da9e74f4a2b081588a00d9ed5916
MD5 a83777cbcefc062dd0f2759798e1850b
SHA1 9aa270f5846cbc9d4b1a57a6c3328742dc6e4da8
SHA512 61ef18dd5f22df93c4fc372a5bc684ec389db647443dd27e0d099b898edb7dc7946c12d8909401829ee4cb4a035cfffa2bbdceedff0cd36a3b81993b16890cf7
SSDEEP 384:nlZcIhsNEK8iPzZHGMCHX58ED8pXR+2/9DXM+F7IzpoO:dhKFzAMka5Rl1DXM9t
TLSH
T179827C75AC78AC7798F3E605F5563A43DFF8606BD2895F90C6E89B1E00862A91307C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3c3de6c0a883cb50c5ca70a30ec286c76b64e062bc7456af66c1652e3585143
MD5 ec3edf36331152e77592431dac0eb5e4
SHA1 b7a8f4b0874d3a3b6dd8aae70d48f01acb7fccf2
SHA512 a3466b3c227f7f8af62f93c59c30e59a95af88de6ea7804c60efe07cbe2fea364beda7c75065d0203ede34c466f46958c2debe22abe12954fc20cc29a4c5b598
SSDEEP 192:1ONl6wlDCQmiUy+T+e4X58gZTjzor2cX77R+2rz3veM/D0U6:1ONl6k+VSe4X58ED8pXR+2/GlU6
TLSH
T17712F834F468FC275DE2A509B08B36939FA52177DA46AF90D6F84B1C00CB35C2B5B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 f22fe2b6643b792b081051249cb592b4f343a3d02d2b2b8d324ea194da46bcd2
MD5 13089db307f91f0fbdc374aa0c5d2fd2
SHA1 f790c883ba9ae2e272a157126019a4e4f0009350
SHA512 fdff40b9f57c619579ea8054eb3af06dc59239b2dd7667a0aacad700f0fc87ef0e1007b329d4e5e1b8b51e43d6af419a057af250c31b96753693f88c447c728d
SSDEEP 768:AF+h0wgsFzArx821dFblnfponoIRpTEfj5b9D/M9t:phNFzWfnxonoIYx/Ut
TLSH
T1422316F198D789BAE9AE97C3633D6E428EBCC167B1884594B3D81E1DDC465BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e84d6380-450d-46f1-bb0c-ee9192224dfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e84d6380-450d-46f1-bb0c-ee9192224dfe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b822acd43d58c60f5a57e06eb7764151e0c40cae6ae577edb46297853fb2058
MD5 8caaf4318652d507f5f9eb9395276548
SHA1 75af47bf11a858f9348ac649430fd4cb07d79c3f
SHA512 daf332baa15f16542586a071f58c2adc9b33febcdf2abeace8cc0618c591b6316a4e10ae0a8da8819d0bf5af4ab79d13cf508ab7ddbdd441ea7bb15d54c00702
TLSH
T106411848AAEA1158B3B77F46AFF6A86E847E7C372F06D46D10110D4F0A22B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 4d88608f3d4bde4152094b60e611d5153ad7f22dc9896f23f4f6270029dd0a21
MD5 294690da0260a0f771fc88e5d8eede4d
SHA1 8aad602af75ca442b483886984c1ba092dc452fd
SHA512 a328d9b56640d913914add799c990132eca1bbfec7d941731713f519d6aedfaef5c76fe4be75abf5f3403293de1789556b07cf64ed3cab09523a6b535bfe5866
TLSH
T172512D68AAEA1118B3B77F5A9BF6B85E847FB9373B47E05D10110D4E0A13640C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

AlexSpoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\07220E7B\AlexSpoofer.exe
Size 2.8MB
SHA256 f9ded3442dd118ed8f295b225763721ae5cb5e6470efd86e9f736a11a329fcf9
MD5 127c4195f090d53e29e325bf444f081d
SHA1 39ba295b5e6e20a053475a17b6e7671eda002935
SHA512 6e7c596d8ec4440ef47b559da8dd0cd32e49f2873a2059d8c429ff2b33c77ef92c01f74bb9b861ecb75cc96fcfa46930dbc1c3e9ea3ef04473d574fa889fc2c0
SSDEEP 49152:Q9eo0UhK4lBN0C/VsoQbdfcVd0tzSNfAdc0eg9aADcN0L5rwWc40D9a1CGiicJ9/:yxlBNLV4bFqfAuifcN0NvcuN
TLSH
T1AFD5DF43FBE245EDC753A138C6129717D6B1B82217204BDB27E0AB929F63AD09F75321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54b2ad05-87bd-4a59-a82b-56c7e9ccb4d6.tmp

Path C:\Users\Admin\AppData\Local\Temp\54b2ad05-87bd-4a59-a82b-56c7e9ccb4d6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b966a81a-2450-453c-9837-1070ad7a0c36.tmp

Path C:\Users\Admin\AppData\Local\Temp\b966a81a-2450-453c-9837-1070ad7a0c36.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 821B
SHA256 dbdc99e614334432fb93758bc5a77dc691932d0c1cf68b17d1cbe06c70a9fe58
MD5 4be455b2f5dda9ca45b6ce6c7a08c683
SHA1 ab904cea8c8b8ed147df0a3f1923bc089906f1a9
SHA512 4af7dddd222f6ca924941acfb764b1e21a872c0a367183aba7296d73532de4c59a4c18701ed56c8c357bebdf37f4aaae25809afd32c9758dc8681d472cf38c54
TLSH
T1920125F03521B73F0BDB4FC490650C942591B152032FAA8CED4A9074BE1CFA3AB2E385
MD5 SHA1 SHA512 TLSH

Submit Download

ba056231-96d4-4aa0-8d38-17a1fbdfd1db.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1240_184154511\ba056231-96d4-4aa0-8d38-17a1fbdfd1db.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3656_1095145835\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-0-0x000001F9AB860000-0x000001F9AB97C000-memory.dmp

Download

memory/3932-5-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/3932-786-0x0000000140000000-0x00000001402C5000-memory.dmp

Download