7246feb461275f99a389d6f59d23bb0d33c73e8c091ba20c91f96786168f57d6

Analysis

user interaction
yes
max time kernel
3s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alle-programme-oeffnen_v5.bat
Size 1KB
Sample260930-ss2flabd94
SHA256 7246feb461275f99a389d6f59d23bb0d33c73e8c091ba20c91f96786168f57d6
MD5 4bd7438b7e7579df833a8deeff28f71a
SHA1 848c24851c10f1a5e32e9e25252f0ce51959c1aa
SHA512 56d32897c6e4e7f8b5578f56b1aa14d795b86e97b4453e1aa3358c827baf6fb12db198afbe8dd8364e14f7e826ec316780b6e3d778ebafbf10e3163f3e6ad2ea
TLSH
T119213F07218A6203AFB3652547069BACBE1C0249913563C330C689EBF817967DBDDD8A
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	cmd.exe

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	11008	9844	DW20.EXE	336

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7204	cmd.exe
5564	SnippingTool.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	chrome.exe
6116	msedge.exe
9992	msedge.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Runs regedit.exe 1 IoCs

pid	Process
9016	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2368	EXCEL.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3688	AcroRd32.exe
2368	EXCEL.EXE
3688	AcroRd32.exe
2368	EXCEL.EXE
3688	AcroRd32.exe
2368	EXCEL.EXE
2368	EXCEL.EXE
3688	AcroRd32.exe
2368	EXCEL.EXE
4056	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 5028	3076	cmd.exe	88
PID 3076 wrote to memory of 5048	3076	cmd.exe	89
PID 3076 wrote to memory of 3688	3076	cmd.exe	90
PID 3076 wrote to memory of 1788	3076	cmd.exe	91
PID 3076 wrote to memory of 2080	3076	cmd.exe	92
PID 3076 wrote to memory of 2368	3076	cmd.exe	93
PID 3076 wrote to memory of 3508	3076	cmd.exe	95
PID 3076 wrote to memory of 2060	3076	cmd.exe	96
PID 3076 wrote to memory of 2220	3076	cmd.exe	97
PID 2220 wrote to memory of 2432	2220	private_browsing.exe	98
PID 2432 wrote to memory of 4056	2432	firefox.exe	99
PID 2432 wrote to memory of 4056	2432	firefox.exe	99
PID 3076 wrote to memory of 1428	3076	cmd.exe	101
PID 3076 wrote to memory of 1580	3076	cmd.exe	102
PID 4056 wrote to memory of 4596	4056	firefox.exe	103
PID 4056 wrote to memory of 4596	4056	firefox.exe	103
PID 4056 wrote to memory of 4596	4056	firefox.exe	103
PID 3076 wrote to memory of 1168	3076	cmd.exe	104
PID 3076 wrote to memory of 2364	3076	cmd.exe	105
PID 3076 wrote to memory of 2820	3076	cmd.exe	106
PID 1168 wrote to memory of 1752	1168	firefox.exe	107
PID 1168 wrote to memory of 1752	1168	firefox.exe	107
PID 4056 wrote to memory of 4668	4056	firefox.exe	108
PID 4056 wrote to memory of 4668	4056	firefox.exe	108
PID 4056 wrote to memory of 4668	4056	firefox.exe	108
PID 4056 wrote to memory of 4668	4056	firefox.exe	108
PID 3076 wrote to memory of 4744	3076	cmd.exe	109
PID 4744 wrote to memory of 4152	4744	chrome.exe	110
PID 3076 wrote to memory of 4928	3076	cmd.exe	111
PID 3076 wrote to memory of 3400	3076	cmd.exe	112
PID 4056 wrote to memory of 468	4056	firefox.exe	114
PID 4056 wrote to memory of 468	4056	firefox.exe	114
PID 4056 wrote to memory of 468	4056	firefox.exe	114
PID 4056 wrote to memory of 468	4056	firefox.exe	114
PID 4056 wrote to memory of 64	4056	firefox.exe	115
PID 4056 wrote to memory of 64	4056	firefox.exe	115
PID 4056 wrote to memory of 64	4056	firefox.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\alle-programme-oeffnen_v5.bat"
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Acrobat Reader DC "
  2⤵
  PID:5028
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5048
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3688
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:5136
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1896DAED89E44E87757CA29440E5CD3B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1896DAED89E44E87757CA29440E5CD3B --renderer-client-id=2 --mojo-platform-channel-handle=1660 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:6960
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AE1B422A4D140B1E70E71242145E5C74 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:7156
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E3F8EC6CEEF12F6A5C8694B5DD85215 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5ADD782124308280E1FFF8014A302C5 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=960B85403D7ACC421FB509CBEF5076EB --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:8668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Excel "
  2⤵
  PID:1788
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:2080
- C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Firefox Private Browsing "
  2⤵
  PID:3508
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:2060
- C:\Program Files\Mozilla Firefox\private_browsing.exe
  "C:\Program Files\Mozilla Firefox\private_browsing.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27099 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {f3524526-0919-4e4d-be24-15b0b9c95120} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {f71587a3-b988-403f-86bf-7a928f77869b} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27276 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {17b56e92-1e7a-40ba-9f51-22291d177295} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        
        PID:468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27276 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {9bdb8d72-4f76-4ed6-8fa7-254db9961afd} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:64
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4492 -prefsLen 34880 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 4504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {d5166cb0-1598-401e-9f63-a7876c01d17f} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        
        PID:5160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35068 -prefMapHandle 4992 -prefMapSize 270279 -ipcHandle 4952 -initialChannelId {1955b012-3d5a-41fb-a9ad-ea6bd26d9539} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        
        PID:6224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 33000 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {2cf9a8c3-cb19-4211-9f8f-fb734c4a4d84} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        
        PID:6628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 33000 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {c9d714bb-0a4d-4711-b7c3-14ca0b80ecbf} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        
        PID:6680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 33000 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {67224031-1256-4fe8-bd72-0f94899036db} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        
        PID:6692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Firefox "
  2⤵
  PID:1428
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1580
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Google Chrome "
  2⤵
  PID:2364
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff65d7c728,0x7fff65d7c734,0x7fff65d7c740
    3⤵
    PID:4152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --exception-pointers=4604205875200 --process=200 /prefetch:7 --thread=8860
      4⤵
      PID:10248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,18199205306093547701,14057536528809028651,262144 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,570249266305114914,11826164983487249115,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1089726992335693670,11848726524764112610,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2316 /prefetch:8
    3⤵
    PID:3488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,861711661764599848,297935849547698190,2097152 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16253485404176361114,15536615671470794821,2097152 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,5534573659750104216,10832745794522126130,2097152 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,11414824097946226309,13750855040260490862,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:6384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,18013369725610454804,939750852965075209,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:7224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,9475265579231461081,13993707461700745911,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,9001952220214110143,10085513218229169089,524288 --field-trial-handle=2020,i,2206221698626618072,7478418004853125177,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Immersive Control Panel "
  2⤵
  PID:4928
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:3400
- C:\Windows\System32\Control.exe
  "C:\Windows\System32\Control.exe"
  2⤵
  PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Microsoft Edge "
  2⤵
  PID:5688
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
    3⤵
    PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7fff5ddec188,0x7fff5ddec194,0x7fff5ddec1a0
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,16189976839204129254,17142104493976964092,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:3
      4⤵
      System Time Discovery
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2924355274767384972,17081610566363629200,262144 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,12546432357027240407,8909587458952730799,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,16900056742014062557,8924275603529847766,2097152 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:6192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3336,i,8664005644964512097,4218071241525747850,2097152 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,15922424612378750150,11820671123758713159,2097152 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8026974429564069315,8340760227090818662,2097152 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,17082916346477340243,9456720788355033814,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,10558294971760695168,14519023552907103470,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11864538144069258632,730111122738356715,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15789787554705709781,15029814758431507974,524288 --field-trial-handle=2756,i,17715654062873620092,16899050993300106663,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo OneNote 2016 "
  2⤵
  PID:5984
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5996
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"
  2⤵
  PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Outlook "
  2⤵
  PID:6312
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5564
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  PID:7632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo PowerPoint "
  2⤵
  PID:7736
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7744
- C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
  2⤵
  PID:7888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Word "
  2⤵
  PID:872
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7196
- C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
  2⤵
  PID:7448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 7-Zip File Manager "
  2⤵
  PID:7548
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7652
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe"
  2⤵
  PID:7988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 7-Zip Help "
  2⤵
  PID:7216
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Speech Recognition "
  2⤵
  PID:7240
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7352
- C:\Windows\Speech\Common\sapisvr.exe
  "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX
  2⤵
  PID:7256
- - C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe
    "C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe" UserEnrollment,en-US,HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech\RecoProfiles\Tokens\{29DC45CE-AA0F-453E-BD98-D73ED7655D11},65552,0,""
    3⤵
    PID:7544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Math Input Panel "
  2⤵
  PID:6424
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7584
- C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe
  "C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe"
  2⤵
  PID:7520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Notepad "
  2⤵
  PID:7552
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6364
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:6888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Paint "
  2⤵
  PID:6324
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6928
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe"
  2⤵
  PID:7696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Quick Assist "
  2⤵
  PID:8048
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5780
- C:\Windows\system32\quickassist.exe
  "C:\Windows\system32\quickassist.exe"
  2⤵
  PID:6268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Remote Desktop Connection "
  2⤵
  PID:2956
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6084
- C:\Windows\system32\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Snipping Tool "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7204
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:4436
- C:\Windows\system32\SnippingTool.exe
  "C:\Windows\system32\SnippingTool.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Steps Recorder "
  2⤵
  PID:7536
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8136
- C:\Windows\system32\psr.exe
  "C:\Windows\system32\psr.exe"
  2⤵
  PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows Fax and Scan "
  2⤵
  PID:5680
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6928
- C:\Windows\system32\WFS.exe
  "C:\Windows\system32\WFS.exe"
  2⤵
  PID:6860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows Media Player "
  2⤵
  PID:2648
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8172
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
  2⤵
  PID:7616
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    PID:7348
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      PID:6668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Wordpad "
  2⤵
  PID:5828
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7328
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Character Map "
  2⤵
  PID:7280
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7376
- C:\Windows\system32\charmap.exe
  "C:\Windows\system32\charmap.exe"
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Component Services "
  2⤵
  PID:6128
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7176
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\comexp.msc"
  2⤵
  PID:7340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Computer Management "
  2⤵
  PID:5192
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1048
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
  2⤵
  PID:8172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo dfrgui "
  2⤵
  PID:8268
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8276
- C:\Windows\system32\dfrgui.exe
  "C:\Windows\system32\dfrgui.exe"
  2⤵
  PID:8424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Disk Cleanup "
  2⤵
  PID:8484
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8492
- C:\Windows\system32\cleanmgr.exe
  "C:\Windows\system32\cleanmgr.exe"
  2⤵
  PID:8632
- - C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\dismhost.exe {B294A2F5-F5EA-46D6-B390-99C5CBA54FFE}
    3⤵
    PID:8236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Event Viewer "
  2⤵
  PID:8668
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8676
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
  2⤵
  PID:8748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo iSCSI Initiator "
  2⤵
  PID:9000
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9028
- C:\Windows\system32\iscsicpl.exe
  "C:\Windows\system32\iscsicpl.exe"
  2⤵
  PID:9192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Memory Diagnostics Tool "
  2⤵
  PID:8504
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8372
- C:\Windows\system32\MdSched.exe
  "C:\Windows\system32\MdSched.exe"
  2⤵
  PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ODBC Data Sources (32-bit) "
  2⤵
  PID:9044
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9048
- C:\Windows\syswow64\odbcad32.exe
  "C:\Windows\syswow64\odbcad32.exe"
  2⤵
  PID:8472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ODBC Data Sources (64-bit) "
  2⤵
  PID:8648
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8736
- C:\Windows\system32\odbcad32.exe
  "C:\Windows\system32\odbcad32.exe"
  2⤵
  PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Performance Monitor "
  2⤵
  PID:6060
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6076
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /s
  2⤵
  PID:8840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Print Management "
  2⤵
  PID:7916
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8028
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\printmanagement.msc"
  2⤵
  PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo RecoveryDrive "
  2⤵
  PID:6088
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6212
- C:\Windows\system32\RecoveryDrive.exe
  "C:\Windows\system32\RecoveryDrive.exe"
  2⤵
  PID:8904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Registry Editor "
  2⤵
  PID:6168
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9108
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:9016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Resource Monitor "
  2⤵
  PID:9176
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9204
- C:\Windows\system32\perfmon.exe
  "C:\Windows\system32\perfmon.exe" /res
  2⤵
  PID:8304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Security Configuration Management "
  2⤵
  PID:7660
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:4772
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\secpol.msc" /s
  2⤵
  PID:8188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo services "
  2⤵
  PID:4664
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:560
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
  2⤵
  PID:8112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo System Configuration "
  2⤵
  PID:7484
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8880
- C:\Windows\system32\msconfig.exe
  "C:\Windows\system32\msconfig.exe"
  2⤵
  PID:7240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo System Information "
  2⤵
  PID:9088
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9084
- C:\Windows\system32\msinfo32.exe
  "C:\Windows\system32\msinfo32.exe"
  2⤵
  PID:9148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Task Scheduler "
  2⤵
  PID:8260
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8212
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
  2⤵
  PID:9176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows Defender Firewall with Advanced Security "
  2⤵
  PID:9080
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8228
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
  2⤵
  PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo About Java "
  2⤵
  PID:8720
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8496
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe" -tab about
  2⤵
  PID:2004
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel -tab about
    3⤵
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Check For Updates "
  2⤵
  PID:6820
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:2668
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe" -tab update
  2⤵
  PID:1496
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel -tab update
    3⤵
    PID:8848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Configure Java "
  2⤵
  PID:9344
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9380
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe"
  2⤵
  PID:9616
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel
    3⤵
    PID:9628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Database Compare "
  2⤵
  PID:9640
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9648
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE"
  2⤵
  PID:9956
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE"
    3⤵
    PID:10076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Office Language Preferences "
  2⤵
  PID:9980
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9988
- C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
  "C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE"
  2⤵
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Office Upload Center "
  2⤵
  PID:4920
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9472
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE"
  2⤵
  PID:9668
- - C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE"
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Spreadsheet Compare "
  2⤵
  PID:9708
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9744
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE"
  2⤵
  PID:10016
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE"
    3⤵
    PID:9972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Telemetry Dashboard for Office "
  2⤵
  PID:10108
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10128
- C:\Program Files\Microsoft Office\root\Office16\msotd.exe
  "C:\Program Files\Microsoft Office\root\Office16\msotd.exe"
  2⤵
  PID:10196
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryDashboard.xltx" /x
    3⤵
    PID:9460
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:10760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Telemetry Log for Office "
  2⤵
  PID:4232
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9304
- C:\Program Files\Microsoft Office\root\Office16\msoev.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoev.exe"
  2⤵
  PID:9484
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryLog.xltx" /x
    3⤵
    PID:9844
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3852
      4⤵
      Process spawned suspicious child process
      PID:11008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Task Manager "
  2⤵
  PID:5616
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9384
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  PID:9804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Documentation "
  2⤵
  PID:5684
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.videolan.org//doc/
  2⤵
  PID:9512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c8,0x2cc,0x2c4,0x35c,0x7fff5ddec188,0x7fff5ddec194,0x7fff5ddec1a0
    3⤵
    PID:10044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,5609755535306384477,15612229197616384012,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:3
    3⤵
    - System Time Discovery
    PID:9992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,994659882254620559,7500709408422370952,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:9988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5521817610827256428,7177500557759456398,262144 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
    3⤵
    PID:9012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,14237462474357847702,757672121653362006,2097152 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:9952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,17291476251051856763,158619032932872505,2097152 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:9532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,12123174295255806539,1672782675231635001,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:10396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5012,i,1753859702444748321,11313080419933118198,2097152 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:10720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3087000149425366493,3771846763379388321,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:10496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,17218556956705337253,4057313794661063910,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,6172249140315237331,5259219185385524796,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8395496521023618366,9617698481394992029,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4250989232065041359,16828424967848606551,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4250989232065041359,16828424967848606551,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1797427845281368986,9210167468440507060,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:8496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,8882809680708489912,9954548377336166533,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:8592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11897020227207771913,1945181424362921338,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:7268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16337459511503475246,16457169802414886250,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:10684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1089817618035213122,3757288111487664787,524288 --field-trial-handle=2500,i,466316888882194466,17385700414724742940,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:11116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Release Notes "
  2⤵
  PID:7188
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10248
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VideoLAN\VLC\NEWS.txt
  2⤵
  PID:10600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VideoLAN Website "
  2⤵
  PID:10612
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.videolan.org/
  2⤵
  PID:10692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VLC media player - reset preferences and cache files "
  2⤵
  PID:10704
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10776
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --reset-config --reset-plugins-cache vlc://quit
  2⤵
  PID:10856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:7068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2016

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5472

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x2ec
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:8168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:8452

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:6112

C:\Windows\system32\Defrag.exe
C:\Windows\system32\defrag.exe
1⤵
PID:9000

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:5832

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 10076 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:10144

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 10076 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:1012

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 9972 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:9992

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 9972 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:7668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7816

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:11168

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:10964

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:11148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 159ddfea3e7b57116d6e0015fec8675e31fcfc994a3dd9ad614400d72f907f89
MD5 2659f7e984084dca344aaad2008196b9
SHA1 83eeda758e70f3800af833f1fee030db8a77565a
SHA512 8913fcd6f925f859f1310a558d85b7eef3f77cf1c53ae24a850b564a23a62322af528820a1a3791e067a6082d9d744dd0e6d90306391a8b4f4c32751a8d12a8e
SSDEEP 384:yeldThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:0+eUZsLQCZsL3hUS4
TLSH
T1A353CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 80092d2a71def1d90a2e0cf784962c4962a5cdbb6e89ad9dc428a9b06a04e790
MD5 2c6a64cd99f8c947bc43fd3a90a0e84e
SHA1 df0de4156c533fd58dd4f3285dd40a2546807fb0
SHA512 ec01f345b2b2c82155deec5a4b2663a7d4a6f3aadab28d87ae4b74b071678762536f1ffd7a4f1023a8aa80f44ee1498eb171451aefdf5b7e6878826aad9b2039
TLSH
T16CF0D4A5187BF4497E47695C047001753511D6D900EE1B4E60AD51750F1F7BDFC1B83E
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 5193eeb61af9a4f692ec3aab0d9a217b1d38581f93b37097bb1e734181e14a8f
MD5 f1eec17da74c2cd88b2c8a6161320434
SHA1 ef31f45fd86896682d81b9d7689d8bc916a193f7
SHA512 e2bc5a420ff5bca4e48a40e7471c7d5f41fdb8a717ecce9c638235f58903071f924a80654ba396fce9202133f1a8871ca018cfd3606b342e6e910d9fe6847491
TLSH
T140E0C02416F6425DF1F8C1740BF575A8D95AF0251412E1B62BD02708630AB04DC62D31
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 bc742e2bb84a32b773848feb59c3ce97682fee233745e71958e157abb991ae67
MD5 3ff65c0f02fb0e201a923b47b9c9bd08
SHA1 af42c2ba2af87d02d8b388db5bc8752fa554d400
SHA512 d976dc3bbc803745b400e1841c1a1f40f1ad1cff00dfabeefd9ceed4a2eb9610274fa9fae103ee22581429a003e9e1ee09265020409551c8cd5fc2f6a61452e1
TLSH
T14D11E182B82BE07069413175E9CB83F63BF1973D08A62275B1C058CEB861F360AA3C25
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 81d29865197565cf1e3da6c0990b2c8784566d746cdfd42b5877303ddf1c3ff9
MD5 c3d577ecbc9c1d63682c9be5dfdd8d12
SHA1 ff616b436a684a5f06fcfce09a790e1283ace904
SHA512 23cf7f7251a09c59cf25b16fcf204a7f76d0754f89aa9231778562464984bad380fea017efefbe0bf9452cb5815579ef817d4a5798135f69692cf0fbf5972d2c
TLSH
T148110482782BE0702D413175E9DF82F63BF2973D08A52275B1C058CEB871F3606A3C25
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 308331537721fe0ea4d0e3fbf3e55c4d55d9757297a9b294c9ab29b5666f97f5
MD5 85c46cb5db493da8bc086043e052f755
SHA1 4f6ae607fd23dd1628566daae1a84f20d713e49f
SHA512 fe99417759cbd9f22733913f4e6b0d006d74a7a78298ec83a1f8b0785d44d207057e74be4c829804596bf2c3b56eb663496c6fbb648a2f10019fbbd5640b0396
SSDEEP 24:TLyx/XYKQvGJF7urs2efOBLfnxLfJQfnUt6:Tel2GL7ms2e4LpLeB
TLSH
T1BA426DFF8E587F73C45146BEE5C152132B3C252E27770092265168B0CA5B36AB1029CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 caad117fc06006d67d689f11064771a2ef3ec8ff50cab46105d281e3609593b5
MD5 c06edf94a5fa15ee2f05097bd68fde6a
SHA1 953d147f50fcbc428513fd6b91fd9c3fc4454f6c
SHA512 7920dffafa6e70b45344d243bbfc17927fdaf429bde3140da88b8a12d4ff36bff45edc8af4c8f48ea908d95216d3101eea694b848c01d531809ccbed13d257d1
TLSH
T1E2F028A5C921EC7B18FE0B6E60680747F79513673790984F3A3C820D8FB553B868AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 14968bf258a817841376ce80ddc0a72960c21a6310fd5dacbe2d7db2d1ce9b3d
MD5 4d68fba31fa396ff40101dd2d92d9025
SHA1 926204bf714462a5681156e670b5d12f2e702263
SHA512 1a638833cf508a7bacce253b925280b3f52e5f77a725a34de86c52d34afd46232cfbdb2ed832242797c6ca0e0c424b29635eba55cbb99b968184197b791f4798
TLSH
T1B54167B7C3D88A7DC90166F8AB152E1EDD690A14522C3D5688D4AE1F93E28F6E20024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dbf95d580be6d4d1c6cf3c7a0383b552817a28f530c262e7692011f1fa1b72fa
MD5 6a675e71b89be8d9f00bd3f612906f35
SHA1 9c1d2a945c2089b43678a3e47e39e370fb5a7368
SHA512 362196567d06508e8d8f7a672d7af21448d2f9782eb3d1600fdc2bfc578428b202de606ce9a5b8326dd2b1acf352b1a9d0f93dfeba230772c1a5c88bf39653ba
TLSH
T181519BB3C7D49A6DC81152F49B217A1EDD3D0A28122D3C26C8D8AE5F53F28B2D21034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 be7a11aa09c4804e099900c8fd6829c49fa5b0a3b01de0c522f9af8670ce419d
MD5 139ac3f0a2cd43d66a0960ab220c8432
SHA1 96489f63f9a5ca7ca9cc645ccc798bb2cfa66010
SHA512 a2c814d283f34b8a629f0cbf6a4385bd74c9e3270bb934a4436d44e9e7d2fc6523140947ad5fba9ca72e735cc8f9f0563c4ea312ed3ab89c669f270668525856
SSDEEP 192:PR4ObmT2mPTv73pAPRp2m9vHsb+WNnvIIdQ6A2PdoIlk0kwTVyIsnAUgtaJ:PR4O+XbUXphwvLdW26OV8
TLSH
T15C32922DBD20747B9DDBD22AEA267B53D7F5102274942E84EAFC883C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 68bc5e1ebe3c09324f0a223105591f571fa1cb6c82b218331f7964c0e94190f0
MD5 ae9ae19f17db7e4e635cd879f70c5768
SHA1 ed35fd51b0b0be0fdcd07e46abe09005c1c76853
SHA512 b635c000ab63dbc17f1e4512cf8bf3ac4bb9057c5a329385c0c3e0c26b8a6d6442e9741d6903ca24d041a608a6d7833b3f6f1c53f0aa8910eda0bf181a7908eb
SSDEEP 192:PR4ObmT2mPTv73ppPRpMTm9vHsb+WNnvIId16A2PdoIlk0kwCVyIsnAUgraJ:PR4O+XbbX7hwvLdN26Oie
TLSH
T15A42A32DBD20747B9DDBD62AF9267B53D3F5202264902E84EAFC893C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3695cd7a1bc5085828ed1dcc14b94e00c1f80fa0aea7fa9ca081638f7a1c40d7
MD5 cdc8e76a35515c2bcda2e9d526edb2af
SHA1 6ac9f656eaaa19b375af9a5ec5a450115f4acd63
SHA512 27d4a0a1105c08c8525c2208f6c49d81b06816624a6f296e91898fa0262a54305581993bd228b610f79a6abc037251e1632eb90ba0fe01b73db74bf49c67c22a
SSDEEP 3072:KF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gg:KF+hFD+7t56OD9ZfSApprg
TLSH
T17FD31232BA95D8BBC9FD6541B147A300DEB668ED51DE3A0944465F8EA09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 4ce8691174253dea9feba3f462aa04e8cb8d5a588fed27f0651b743b63e43836
MD5 479ddc6fd33b695245343e08a7f43834
SHA1 f5060bd7458e0caefccead690948115596dc00d7
SHA512 7913addb363395eefadf7cadc74a5cf1609030a041c68d4e9bfd24e5a5286a07b71b931575ce8ad319868e9c2b6a1e110c882159cbfa4d781fdc28d7b194dfac
SSDEEP 6144:dY+Dvz0p3IGzzZDTN+hFD+7t56OD9ZfSApprd:dY+fM4GRPNyFSXD9ZfS4H
TLSH
T1F24412363A919C7785BDE150E06FA134DE68C9CF42EEAB0944425F8AD2AFC4E0657C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 4867e9f3e6427f242f8665da2480125fde86c7853ee864f846fafaa3f8c4904b
MD5 83b806414c17392308322d2839331bc7
SHA1 52c0404425223aa51af34016bad6390ea3d14971
SHA512 1e21f59c1cf0ad087ef8a0f7c8c6668a822ef777e2e4d1d6df83717ef890bbff696d238dd9b9b8ffd14dd157666f175c72557566900e499df5bf711588792f24
SSDEEP 6144:I+Dvz0p3IGzzZDTN+hFD+7t56OD9ZfSApprd:I+fM4GRPNyFSXD9ZfS4H
TLSH
T1844412263A959C7784BDE050E46FB134DD68C9CE42EEAB0A44425F8AD2AFC4E0757C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c27cbc99e65d1f8bff10596cd80031d71f1af9550c5f474829dc520b892ba4ee
MD5 41d48c71aa10d5e68af462f2ee2d1a6b
SHA1 1abb566590f6002e11e7a41c69728c4be44f056f
SHA512 b59a9fb9f981ef2e2659b2217576e2c5033a670ab60a9ac75911bbd23370d75b344ab11f73caa333b36a774b5a515c038b6dd1f5cb82be6d06ac10b26c8fc0fb
SSDEEP 3072:5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:5+hFD+7t56OD9ZfSApprZ
TLSH
T1C8D31232AA91C8BBC9FC6541B197A300DE626CED45DE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e681a5677e5667a21034dd50b2f37c09f5079157f79e7a7a6e8108426a2d4808
MD5 a9beffecd4abcce227ba9825ec566ef7
SHA1 50658edf3053bc1af90dc5fa86c04fa5112a8d5d
SHA512 5e957f29163ad4697d16cd7ce5c194e7a9f673c8e8bfb720ad11586ae7fd1d201d56b5cfb30d402f0ace97c8af9de274242d04c257bebba825656f2300fc8d74
TLSH
T184D080B49D689AE4D0A5307D5335454173DD97529603210D65D10A150D743D31591CE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31f30d5dffd9b91cefa25156c7d1b33e8d2837f39b889ada7ef411b3b5139b48
MD5 c6759facc515833a3bfc40238bb44205
SHA1 087c7d6159a92c204135cb8be4639296f74dab85
SHA512 f631e8ced702cea5c83ff78ee7cdfccb4b72c0bb97af26181a2b1746d5770e78265a7b6d8dbfcb618984d8d12f717a9de30f643481b9be8f3afa43539b3d1884
TLSH
T198617184C2E2406DFB65CC77D2F40E872A29A94058932F42217BFF75AC07FC4E1AC0A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9be7a00d226d7423598fae5387892eedd6478a943342ec5a23ec571a1264d9b6
MD5 1413bc6d092b10ae68be1a0063dd24a7
SHA1 653713dbd1e554faeab51ededd27f8e14ff4def3
SHA512 f957346c7d85e63a38284a69636630c20c4233068bf6ab71349b29972e2d505fa0b3e1ca40853f3a2ca82488d80db77233e770d2c6876727424b021da941983e
TLSH
T12C717285C2D2446DFB65C877D2F40E863A39A94158932F52217BFF75AC07FD4E1AC068
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cb1b.TMP
Size 3KB
SHA256 37a9c1235f36b7068471ae9507717269536a01f17c48a51b113a7dfd4f5e338d
MD5 cd02c40d75ead83ace8da4fa4c385fac
SHA1 04edcbccdef936404f098474effcdb65505f31f5
SHA512 e4772538e928e093be195ac7f843660c7a4450bfa4a876c495148e652dc4480b9c029fe8fc7e6eb8428440821984202e6cf20b3d9cb52c2e75d1d35fb4d67859
TLSH
T14B613D8181D2446DF7A5C973D2F91E8B3E35994098932D4221BBFF798C0BF85E1AC058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d5fc8ef4b1dd60ca3294f647dc83b87cdc9b5acf84d00ee4d2e1c61212c0377f
MD5 63052c7a266b590c97a4510ee4652bb0
SHA1 e6d57d7716c6f87acee834ae664de44ca81103f0
SHA512 88f6aa42f9709e3533189a1fc54942c851977a3d63982a6a1d95245be58ee17e24c605e31d6920089b12db8603c8886968bfacc2c296552b9d158b989eb01805
TLSH
T17E41BEF7C3A5857D9A1195F4AA049F1FCF2C055243AC3C5A85E45E1BA3F2CB1E041A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 839541cc5fade914e5101bad46fca3178130a82b44f4369d6ca9f2d2f6cf9045
MD5 ab0b3bffc8d45e35f88114631b7f08e9
SHA1 eb6f06db87bd6e863be3e7e91a7eacf98210607f
SHA512 2fbecbbc1f4fe1863d88f251077c3fc5e8622e132171eeec9b4c772ab96ac2271448f55b067061fee1019680848b9ca76df9f9d2ee729c90f3dc485073e37c02
TLSH
T18441BDF7C3A5857D8A1195F4AA04AF1BCF2C0552436C3C5A85E86E1BA3B28B1E051A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4d0dbceca641182cef155240a7fed6c5b800c07fb715f39052205904ce01615b
MD5 0638b7c8061ebb95063515a735420eef
SHA1 22982136785bb2139ce4a5aa1484058c7c74102f
SHA512 97a3dc87f897e3a59db83e4351a4dee69f8e05e4c06563b4a4ecbbbf9d673b64e405adbc9445d12d6f52c70e2b739f468f160c291c8b94b16ed56bc87855b3a0
SSDEEP 192:sxZRRaZ8/fXsDQWpVrxHbQ+Mdpm7HW6+WNMZFC/YRPgt1MIgEJ:sxZRQ8/fXsDQWvrxE5oHb1/mKmI
TLSH
T1D832B6427E28687FCCDBD61DFA257F53EAF91022A1D15E98A6FC891C04E66DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 03fe1fa3a442ab5c94b45f1292a4d6e25186e3ab451b9a21ed8e97022cc8d7ed
MD5 376042bad5994564c64887ff7e008657
SHA1 5db7afb3b1d8be0f998d6422b00bb8dc70db4b7e
SHA512 62d50f1accb0b006bda67896a30d7e0efcc06e48041869aa8dc3bde10a513e842b995c4d53e60dba63b2f8dabe21c2ddfaf73cca384be72e2440eea793469e22
SSDEEP 192:sxZcQUnRRaZ8/fXsxWpV1x1bQ+KkdpmToHW6+WNMZFC7kxG/P2ZRPbtr+OIgEJ:sxZCnRQ8/fXsxWv1xWeZHb1v/uprvI
TLSH
T10E52D6427E24687FCCD7D619FA26BB63E6F91022A4D55E88E6FC891C00E66DD1303C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 419b9b32352212fe980752331ad294b08282cfa81753e57b28748f2cf8d1afcd
MD5 4f0708eafddd879c8b3b27d71774954f
SHA1 4aa64dac42abdcdb5d063af84f479c4a2f67de51
SHA512 1b28b23ef00224385418f6a52661cc085a7660c4520ce8fb52bcc84f094bc34f031134821da66d2efa4d3f5ef9067c277f02813a10c4c109a6320eb78b7db591
SSDEEP 192:sxZcQUnRRaZ8/fXseWpV1x1bQ+KkdpmToHW6+WNM8sWFC7kxG/P2ZRvbtr+OIgbT:sxZCnRQ8/fXseWv1xWeZHbkv/uJrvn
TLSH
T1C952C6427A2469BFCCD7D219FA26BB53E6F91022A4D45E88E6FC891C04E67DD1303C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e747e5ad51b8595cbcd4f9ca02a7a741a5c807d4af9be6fb15154e2c0bd6159
MD5 dbc7cae0ba223573a1dcaf0bbfe26686
SHA1 bb717ae67f0d9b3e56e8b4a34c07eef5edb0e9a9
SHA512 0ec3540c054da8f4530a2570d9f41541f647f65878aa9c310b2e536d77cb568b8eada4c8beaca4028bbd30c37b1297975fc8644957147ceb269af60dcd9f3660
SSDEEP 192:sxZcQUnRRaZ8/fXseWpVHx6BD5bQ+KkdpmToHW6+WNM8sWFC7kxG/P2ZRvQSr+Od:sxZCnRQ8/fXseWvHxVeZHbkv/ufrvd
TLSH
T1CC62D742B92468BFCCD7D219FA16BB53E6F91022A4D55E88E6FC891C00E67DE2303C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 17a9995aead44ae1dc1e9d0d36980de7dc67c49d2eda0e6fa8733d835dbd86ea
MD5 afec647f0201549af2c389d70dc505d8
SHA1 254217ab0d40b017d3e5a1dfa153b91c6d7db096
SHA512 6cba4b516f01966c76c897dbc9e2578d03ea1452a4f77994f59fe721ec462e087c20bdcac0deafdc84518c10e2c0fef09ae940c1ee124e85cba12b10e7c78acd
SSDEEP 192:sxZcQUnRRaZ8/fXseWpVHx1bQ+KkdpmToHW6+WNM8sWFC7kxG/P2ZRvQtr+OIgbT:sxZCnRQ8/fXseWvHxWeZHbkv/uarvn
TLSH
T13052D7527A2468BFCCD7D219FA26BB53E6F91022A4D55E88E6FC891C00E67DD1303C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6c50d9b353354a1921cf75d235867be23ff96084c26c33e835d8ecb518e0b1ce
MD5 350438358a5bc60e43ed3e5c35a5ae58
SHA1 6c27a130010f5feb16f774dd494f70d2c5ac3516
SHA512 a9a4b0ce51b4bf52c61130f3c55b66aeb2c51a851b57d1f32677dd94ef2706df9e6a671131b56ecf8dae7ef7b6b370995d4e1b612bc21f3d2b813c2f23906859
SSDEEP 768:0iK9ueYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfHLlh7k3/rog0br:0iK9ueYWvcQWsu1jakHL7Q3sg0br
TLSH
T1F1C2093F640CCB7E4FC01AADDC5A6F972E9802D7A6684D5047FE944C02C77EA62264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3fdb85e0f0e48c6338c1514ae403d14f8458e05c90672743ac8e9ea1abd537d6
MD5 8a1687e0ea73afc8e7018ea45a083591
SHA1 053585f07d027a2a1a3e72df4985fe795887cc00
SHA512 3b82ca0bc40d7880024233805a901ef429488d46012c12c82012ebf2cb4eb2ee6665f54d987c869bc2fc05aae2ce78d7be171d4e8bbaba796e7597e3db05139b
SSDEEP 96:K0mgyR+isQMoIo77iKoK6tiUomqqrUilPHKlZH1VRI5YMiBRK6YinRmP3gBggoKp:Xpne/
TLSH
T15B91E35130BB02817D7E254880A5972E625131F2355CFB6B7BBD14E24EAEE041EFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3d94b8956ee67e4aad1fff4598b480daef4da0d03e02cb5495ac05d48dc93824
MD5 d9abdd6531ee7c6cb11d4e7dd45b5c40
SHA1 55de9e9e969becbf8634696d1777f4ff569a255c
SHA512 e772bcaeeb0aa5e6cbac6f393f08f2d070b94fcfe5b238b47df4aa02f56ac4fb37b9876c79274802a2d86ad9f110dc0999fdaf7ff2d375a8155c806987f0e142
SSDEEP 384:z/sN6UkXT1rspbaOjTV+WOiGewjE+2tkXOF7Iz5x:b9JQZnzODjEltkXlx
TLSH
T18D522A3578645C739CE3A646E54A36039FF841A7DA892F94D4DC2F0D01DB6AC630BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 68fbc50eb3e2990da25843dfee0bd3272fc898915bdc70806ef3e90f19cd5601
MD5 a716c0a713bda8945f14499b5a159a08
SHA1 2d8dd960c7aedfc62403c03a3623e2e47e0af270
SHA512 addfd92d216196e372542c6d59ab6b7fb960717e70ce5eb8e7aa927d28f1d60db0581323da4d1ee5a3db0509d6f5a1e4af42234225a7d5798dffd9eed35f007a
SSDEEP 384:ztsNJRT1rsKyaOjTV+WOiGewjE+2FMGA3t89wlonBMKwIr+ZXo:ZUaZnzODjElFo3unyKwIr+ZXo
TLSH
T16A7207B0E8A45CF74896E5C5E146F213AEE81077D9891F4CD1F8BE3C308F6B82716866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 9b7ea8c8c564b6059cce03166d0ba8277d98a2c5847b2cd8614f29e7270490df
MD5 fa0c76232cf6077f58524fa0a1b98714
SHA1 610442e6911c0392f09aadba7991635aafe0b424
SHA512 621951cc4dd8f94eb886284e2f5c84b59380bb98324116b2cf3bb27d93cd148d19a0f995cb0f7ebb47673c2dd226704502e9061cb490d53a8a6c73a2733ecce3
SSDEEP 384:ndZcIhsN6UcXT1rspZx2OjTV+WOiGewjE+24kXOF7Iz5goY:Fh5JGxNnzODjEl4kXlgv
TLSH
T137826B717C745CB75CE6E246F68A36039EF88063DAC96F90D4EC6F1D01DA6A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35e34c609b592ebe8eaa39256f349e4c70c7585ad62a5e09e975fbf502d76d00
MD5 c1c0918b260760e27e8ec4eac7ac3c84
SHA1 db988fe49480fa952c52b59b95fa5d9abf3cb09c
SHA512 31a79fc496bf3955515c114714581026b54da75b7cc4d22248700b260def17c41aea59527427cbe9599bede4e2219f2025f25a8ee669040b1625b3810b88e9c1
SSDEEP 192:SONu6ygpQmiUyTRtOCTVg5WOiR0KzPnZAU6:SONu6lHktOCTV+WOiGUOU6
TLSH
T17002D834BC682CB79EB3AE06F48B37179FD8116BD9552B84DAD81E1C01D766C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 90fca6b781890cfafc55c5f48008dc19cbf9dcedd392bf62111fc4f3c0a498fa
MD5 889347ea514552c815d5117f4ba8d210
SHA1 10047f75f11a5426a596d9adb3982f3f44e31324
SHA512 a128e7ddb75953dafb9d6862c3a96128c6b233b7c2f4b321a110a2b0aadb2feef179dbf0f1bd16ed67016773d127f22a0f4f72c3e55d92fd8924b115b461eed7
SSDEEP 384:ztsN6URT1rsKDaOjTV+WOiGewjE+2TkXOF7IzC:ZkrZnzODjElTkX2
TLSH
T163422975B8645C779CE3A646E64B36039FF851A7DA852F94D4DC2F0D01CB6AC230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85de221ccef166ddea4b624ed5b1e8671ad13091bf0fc1d72915736b02f03842
MD5 b069b0a2472fa71f0ac8ea724b5d2eaa
SHA1 f1658ad1c6e30fc16a61c9fbeb51ebbb588569af
SHA512 8f52852003b64b1bd40b93c311a2cdd56b217f3a1bf21b52fd135986c51c8da6d651a3ad075b894c27df43b3f7a8d7bad8288f8926bf3b6bde8706970a2f6663
SSDEEP 192:SONc6ycQmiUygRtOCTVg5WOiR0ewjE+2v3UnZqISU6:SONc6HJtOCTV+WOiGewjE+28cU6
TLSH
T1CF120831B8786C779DE3AA45F48B32179EE84167DA866BC0D5DC2F1C01DF66C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

496a8b17-3011-4490-90d9-2c2b66444509.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\496a8b17-3011-4490-90d9-2c2b66444509.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

remoteassistance.support.services.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LYPUXCBP\remoteassistance.support.services.microsoft[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 abaead315b9832a75649ed25d903e0740225d1c09f8aab725c83472fd892c1f3
MD5 fe225012a521906e731686baae116d00
SHA1 233218429a5ccea352129bca1c2f3c978640f175
SHA512 3d6090c03c0b0c969397254002631db31d21013720a3bbb3956773d3613a1903981e20e7e1fdf4130cacf4f680ba04a25dd6b66c6b7e0965360ea125b263f87e
SSDEEP 768:Ff0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdbj:F4ZPItFPuNnY4UmqEMioTaBacg
TLSH
T1AE152037D150B085CF2C75B1E5AD5F0CBA23A10B12E052465FB4A67BBA633C98D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 16f4ef74e233dcbceb62a0d4134b2ae9c3846a23080ce71a1554fa77b36b2827
MD5 8a311379405ce140a1b9b2686f044e99
SHA1 9f9707518acb07215ea77fcc510ed858303115fb
SHA512 dbb8568339d8673fa5cf7043aedddfca142b2ac7ccfe53dc88075dfa124e35fde5ba48e6863ae95b8b508f2db440ddab125ede0c3e44d15a463f4f85c3419bb8
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba/:rZP2tFP3vqY8nqEM5tTaBacg9
TLSH
T19F258537D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 9986579b21053b27207b3143446e39bbe66f1129928efc4c9621379ff3b22b16
MD5 9436ce706e7fae322725fa7656320fd7
SHA1 83e8fc51b317312a772201a305856d7966363ce6
SHA512 84aea8f16b7cff2fa71bf8e99bbafb65f4a71af63e99c94a518226fb25fffc4d5250ece0daf16cd261e70fa1d8fd6e286ac11f9158f07c69b8dea96650300245
SSDEEP 192:4BWF3nynRynKFSBj5Itcyx2RhJ5b+o3GQn2nu:7eQqRxyhnao3Q
TLSH
T19D639A1166DD529EF3B20EB129E7D6160F6B79A44A34C24DB27C010D6F73F18B920B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF5023A4-F8DC-405E-8D16-0738C7C82C37

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DF5023A4-F8DC-405E-8D16-0738C7C82C37
Size 192KB
SHA256 4d483b4d4a523c20ee4a2083fbe58611b1e6b72c9a3c48bd3536482f5b079221
MD5 dc3110fe785a43521973e65f7a0ebacf
SHA1 e12c882476a65bf3ced82d89d9806c449c09ba21
SHA512 455184b430cb81788d625db00f20de2fe23e49a6eb0b4b68015c0748b1cfd8b528b9ecc9d88cffab74d11ab64e6750b724798cf006b55b4fbd0c87e229011201
SSDEEP 1536:hrVe3b3yFK6ZbMxsghEa8e7HWsDXjj/mLJcAZl1p5ihs7VXX3EKD0aO7qamZdGVm:2ke7HWsDXjj/IXE57cV
TLSH
T1EB1412A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Size 1.6MB
SHA256 d5da9bbe0b9503765dc7af791330619d5a70fc17215c4a8a31314b22bb3b118e
MD5 cb06167b7505a8149f2e074a8f5296fd
SHA1 73266f896e8a6ba56695fc6142e4363849eae344
SHA512 861036e8d140a417dfd852dfcc3f417789e25038060b3366acc9d14c5a0ad11c66704b5f94d3e348804465db7601678e30c5987421c13e9fd5eb36be2ab1ba3b
SSDEEP 6144:xAqfYrFSZjTFODups4BTCHvrPoc6fm50eki2bkILZLlSq1E38OB5:pBTevLoc6fm50eki2bkILZLlSq1E38O7
TLSH
T156751F84E0D365136B79E61193A29EEEEFA541A39AC47180305D27BB9F37CC50D0BA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 05974ee77ef65cac0bb2d7642efabab269715ced35e398ec0e0d7b2676b23229
MD5 9e92a34d7ec554d8fc83dd46e40b17eb
SHA1 8950493a6c9ddf5a6715752a0368d621b29a821a
SHA512 b262e3be5bc9e220a27552c9bfa956459968936646c8e1ec25fd9a9fecdbdbcdc55fe65ada7ba3e23d3f5141d9ab3621e4587c35b5acac1bbcb194e25f5870c0
TLSH
T1AA416D5CA6F91108B3B76E5A6FF2A86E087BBC372E06D05D00110D4E0A23F40CD62B37
MD5 SHA1 SHA512 TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 69a99fd8e08efc4cf2d4ce32c2911c115a6195cbe3ed8602a6289d32e47d769b
MD5 63d799418be2b9974066a6535441cd77
SHA1 37251e8a7c3f281018e7d58b7cdc67a3c41cf541
SHA512 c61300b6084225742adc81ab25e19f136e2e16ea80983f2a08cecdbad55ecfb327657fddbcf02caff7f2b268793fdee09fb3633ffb22ac09f396e42f10cd8e31
TLSH
T128412C58B6EA1148B3B77F5A9BF7A86D487BBC372E06D59E10110D8F0A26A00CD71733
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 ae8a4f8ff65476bba2d7bd084b20d6f279121a4b625cfcfba77eaa7e89363b5e
MD5 376fd3bed255c9cb09320f65fa51f713
SHA1 0f831293344cf20c26ff97dbc292236084bcee7d
SHA512 9cf8cf13a09ee42bf7a18ceabf83214857e43fe26e91d8d31472434fb450b11110962a7f42cb13a24fe6d8e41c4f8f1aa16519bca76115ad1165720999b5f83c
TLSH
T182514868AAED1148B3B37E55ABF6796D487E7D672B06D49D10110E4F0623B40CCA1B36
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 88a76b9f2f29634165e7bcfba590431046afacddf4c3cdbdb981715e4a69bd5c
MD5 101588ebfe5370a1a862ac6b870f1173
SHA1 b7df221184e0825d2a12a3554eccf5f8878e20d0
SHA512 adee5355632e228533a4b37bc24ffdbd1fb4ef8b609cb3a1f38c1a49ec66cf04981d3176e78dfdf2e7b2b01fe129fcaffd1768a97581cc3d3d10ac885030e55c
TLSH
T14A41F658AAFA1048B3B76E56AFF6A86E54BFBD773E46945D10010D4F0A23A00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee4a6c504692808ccd4cfce5896828ae557cb3dad3314f4193845104ac11e1ce
MD5 6a27d6a6fe0c09e78c7f9f0254db1a89
SHA1 8bfd81fa2b105e731737d196a2cabbb3d7e9817d
SHA512 4f767f4182aef3ae534a46319e45748afd9784649134977ca541a12bc053c4a43b64e7fe5bed95011823c94425ce0488eaaf4cf13ef0fc2ef13607de5ab9a0d4
TLSH
T1D041EB98A6FA1144B3776E5A9FF6A86D44BE79772E07949D10410D4F0B23A01D8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 9651683fdad3c25916e6e2fb32c190f55830c3fd96eb5fd5117907f6cfecf220
MD5 7621637d537d6cfb3b31b0e186a98e7a
SHA1 f2a6e7827014b1817fd0a146b7022207bfb4d45f
SHA512 0c49d65ef5d30e08ad69849d3e15603ddb3f19ce00fb6199b6483f3da1bb61ae8a695ffd2aa4b8d006024bbe87dbb6ff2bcd81164e5c93ffbc89c6b76725ebd1
TLSH
T1CA513E586BFE1159B3B76F569BF6A8AD447BBD333A0A905D10510E0F0A23B40DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stylesheets[1].css

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y8RORA7G\stylesheets[1].css
Size 107KB
SHA256 47feee22e4fe714a71556fb547a9181a6d4baea236474f0dd6008397d464e7ae
MD5 5d85c99416b8462194c4dec4910922a3
SHA1 776639bcc25efd9cc7bc52dabd128e27cfe69e27
SHA512 a0b6666fea79860bccab9ce94dab7a257af7a1fa1a285da13d02e1e30a30f61a41837955b71501c7de1331e6c870fe6b7011c6de3a4f4b5cbf68804e21316693
SSDEEP 768:UhseXBxxMNrqGMTXIxW5e2qgZKwcJrVAGmTtzlz:UhseXB+WL7cnK5zlz
TLSH
T1BAB36159C6812727A63F52BD7BF1916AF7604557CA0257F839AC10088FFD8E8A123ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 97691f7f9f78f6fd9676abd9e600113b3416d929387943446121b86ee81cf779
MD5 5552c17a6c5fecbb0d889113bb09756a
SHA1 a3b1fbf318ac4ac4cd7705e8c3fcc35ad4d8dbc2
SHA512 1983a14e6ba5d931f6fcd82ba44936eeba01ecc020f5c439d40c631a9730715ca52a95c42c1a2965dfbf93da2ff5d62709550668d600bd5c7da0ea5f29ed4777
SSDEEP 384:HalwSiO024YPWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+nS+J:6l8ZYPWTToXJWTTogB7S/AmVAf+hRM2S
TLSH
T136728D7D8F413CAC275790E8C8BA43598C18B2A7DFF5C06D269C3E09C984A1A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 8b29e175e6a90f844426322d56518a7b2c057194b5cab67495d2ae8d541776e7
MD5 337afc43a0dd33f2ab9cde246c9a2472
SHA1 089d4091a9093220c7671784c6c7e2709790aab6
SHA512 5ada985965a3d779e24b35c526657c8cccaf3a7ffdeb706459c943eae5930bad7a2052474ba54a1cf36f63444af9c3887060b2aee9b66bc088ef09db7cd2d435
SSDEEP 3072:j3lLCdFTK7eU+q5r4nY4a1pufDfNCm6BAi:pWbK7eU54ZfDsmuAi
TLSH
T109B3BFB6DBA28D7964FFD42D9BC2883EFD262400F3A7300DC913275562C5FA86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\AppxProvider.dll
Size 554KB
SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
MD5 a7927846f2bd5e6ab6159fbe762990b1
SHA1 8e3b40c0783cc88765bbc02ccc781960e4592f3f
SHA512 1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f
SSDEEP 6144:TiBcTKZ54SpjXqHKVM8GoxYJwUbdjQzFAPdi3tebF5yf+Q6yLn7xTPBc3:uBFXWUcyziktebF5nn
TLSH
T1A5C4C61E67EC0514D0B6E1384AB79144FA7278221B3297CF6181D33D6F7BAE85E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\AssocProvider.dll
Size 112KB
SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
MD5 94dc379aa020d365ea5a32c4fab7f6a3
SHA1 7270573fd7df3f3c996a772f85915e5982ad30a1
SHA512 998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca
SSDEEP 1536:yV9TBLzWvVZtglIDIQdgDbEyuh9UHsTj2HUWli7HlzuTPxwQ:yH1uL6IdgDWjUHeEhyuTx
TLSH
T1FEB3C55A37EC9151E1B2A1388962864497B7BC605F3297EF20A0A33E4F73BD44D35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\CbsProvider.dll
Size 875KB
SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
MD5 6ad0376a375e747e66f29fb7877da7d0
SHA1 a0de5966453ff2c899f00f165bbff50214b5ea39
SHA512 8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
SSDEEP 12288:kqe4tO+jP4PZxP2gv4MefWfN3bGJ0mqs7xBU99l7gghi000U:ko4+UP3P2pMefWfN3bGJpv7QLl7hi0M
TLSH
T1D515D21D67FC0548E5F7A6B88A724654EAB2B8225B36D6CF0000C23D5E77BE04E75F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\DismCore.dll
Size 402KB
SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
MD5 b1f793773dc727b4af1648d6d61f5602
SHA1 be7ed4e121c39989f2fb343558171ef8b5f7af68
SHA512 66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed
SSDEEP 6144:2pFC8Q92GEAjR53dcPFj2loO4KwbPnRKQo2:2pxQ92QjR5tEKCkK
TLSH
T1E794F81DB7EC4495E4BAA13449638649EAB2B4611F3293CF2390C33E6E33BD46A35F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\DismCorePS.dll
Size 183KB
SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
MD5 a033f16836d6f8acbe3b27b614b51453
SHA1 716297072897aea3ec985640793d2cdcbf996cf9
SHA512 ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871
SSDEEP 1536:UA5jxij1/4CL6FFJbK1hipbLEXt0GAwlPat:UA5jAj1QCL6FFJ+1hipPEXtpXlY
TLSH
T177042F47B6208423C828A232445B4E5EB7B5DF94D7D6079B2068727ECD7B3C19F396AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\DismHost.exe
Size 142KB
SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
MD5 e5d5e9c1f65b8ec7aa5b7f1b1acdd731
SHA1 dbb14dcda6502ab1d23a7c77d405dafbcbeb439e
SHA512 7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc
SSDEEP 1536:16iNEP0SZpv0aVyo0rbRmiUwhjgPp9X6E79KfmeCUhNs4+Au0ceacoM1f/TnbsnG:1rEME0FgH6ERKf3/lb/Rw2siUuaqR
TLSH
T108E3191E77A92099D166913C8285824AF7B2BC30171257EF16E0E27D5F33AD8BE39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\DismProv.dll
Size 255KB
SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
MD5 490be3119ea17fa29329e77b7e416e80
SHA1 c71191c3415c98b7d9c9bbcf1005ce6a813221da
SHA512 6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13
SSDEEP 3072:cKvrcFu+XXythARfaBAUGNDBOZlUsJY/xL6LyzH7vt/MEhpw9nF:kFBXytcaCUGbOZlUsJaxO2z7vtxhK
TLSH
T1D744F81D77ED1C55F8B6A13889628A48E6B3B8204B31D2CF1190D33D9E37BD8AD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\DmiProvider.dll
Size 415KB
SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
MD5 ea8488990b95ce4ef6b4e210e0d963b2
SHA1 cd8bf723aa9690b8ca9a0215321e8148626a27d1
SHA512 56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b
SSDEEP 6144:Hx/vIsFo3S/cEeMykrx++h0kra+gIEmHK:Hx/vrs0FeGxf7ZVK
TLSH
T18C94C41DE7EC4854F4F2A27849728644E6B2BCA49B72D2CF1180D23D0E73BE46D75B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\FfuProvider.dll
Size 619KB
SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
MD5 df785c5e4aacaee3bd16642d91492815
SHA1 286330d2ab07512e1f636b90613afcd6529ada1e
SHA512 3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745
SSDEEP 6144:Dl7JmNA6s7wJzYlfa4QsFIKDys3NvGvcIKifgRw/zJkwT/F0MOAYIfsA46ItKata:Dld6A67qjFVKVSw/au2A4DclSZkL
TLSH
T1C2D42A1D72FC0195E1BB96788A634225E6B2B8302B3196CF1160D27D9F27BD09F79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\FolderProvider.dll
Size 59KB
SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
MD5 4f3250ecb7a170a5eb18295aa768702d
SHA1 70eb14976ddab023f85bc778621ade1d4b5f4d9d
SHA512 e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569
SSDEEP 1536:sexLd+GGpAR1uFs4mrYNjTURz6dZiFj1EOt4Pf2:skUG+EIFRb9TURz8iFJEOt4n2
TLSH
T12353295ABBEC9081E0319078C96B8F09F5B6F1201B1257EF11A4C37E2F777C49A35A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GenericProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\GenericProvider.dll
Size 149KB
SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
MD5 ef7e2760c0a24453fc78359aea3d7869
SHA1 0ea67f1fd29df2615da43e023e86046e8e46e2e1
SHA512 be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f
SSDEEP 3072:WvIVEykJhkBPNN9/Y/6xOi/xHVpbe01cPKZoq:WvsEyChkBPNN9NNDbeacPLq
TLSH
T100E3D61D37EC6165E062623889668648E3B3B8605B2297EF11D0D33E4F73BD86D35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\LogProvider.dll
Size 77KB
SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
MD5 815a4e7a7342224a239232f2c788d7c0
SHA1 430b7526d864cfbd727b75738197230d148de21a
SHA512 0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349
SSDEEP 1536:X9mLBNlc4Rd1wbNA7elgn0+r+GEJ8a0qMX0Igx7DAJoNxPyCp:XMLlBRd1kSels+T8a0qMX0Igx7DAJoN7
TLSH
T1A373071A67EC6049F072A13889728B49E6B2F4606B3243EF5194C37E1F37BD49E34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\OSProvider.dll
Size 149KB
SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
MD5 db4c3a07a1d3a45af53a4cf44ed550ad
SHA1 5dea737faadf0422c94f8f50e9588033d53d13b3
SHA512 5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde
SSDEEP 3072:mT/wD4tK821qqa4SzpVYJyAu27gH3MgDXGy:mTasK6LpVObgH9DX
TLSH
T1CDE3E51977ED1095E1FAA57889B58A49E6B3B4201B3293DF1190C33D5E33BC8AE31F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\AppxProvider.dll.mui
Size 22KB
SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
MD5 bd0dd9c5a602cb0ad7eabc16b3c1abfc
SHA1 cede6e6a55d972c22da4bc9e0389759690e6b37f
SHA512 86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
SSDEEP 192:WqLBjDHbtptJt5MNxWJtrtutAtKt0tptj/eCk6tf6voFeSMoLH7/x9Wg+WA:WqLJDrLpMyYWbWoFelCH7Z9Wg+WA
TLSH
T1DFA24E4236FA5119F2F77BB86AB716650F7FFD62E934C60C1258511E0FA3A818C64B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\AssocProvider.dll.mui
Size 8KB
SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
MD5 8833761572f0964bdc1bea6e1667f458
SHA1 166260a12c3399a9aa298932862569756b4ecc45
SHA512 2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
SSDEEP 192:x/Akc8dT8EC1y/vYsCAFdUTFLrNmAYKkA48UGtqWKKWr:TtsRbIWKKWr
TLSH
T133F13A8263FE1659F1F76F796ABB22210EBF7C559C39D61C1688521D1BA3900C8B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\CbsProvider.dll.mui
Size 53KB
SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
MD5 6c51a3187d2464c48cc8550b141e25c5
SHA1 a42e5ae0a3090b5ab4376058e506b111405d5508
SHA512 87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba
SSDEEP 768:s34QoxGHbXqhu7dCJ6zoROa9fOLBzZoL/ug:s34QoxGHb6huJCJ6zoROa9fou/ug
TLSH
T14A33BF5163FE5509F2F77FB85AB606694F7BBCA2E839D61C1294111E0AB3E408D60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\DismCore.dll.mui
Size 7KB
SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
MD5 7a15f6e845f0679de593c5896fe171f9
SHA1 0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
SHA512 5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
SSDEEP 96:w4aiiiWwdwCg/PCpQcBK8Cq9ovnwEWDOWwo:JpaJWDOWn
TLSH
T170F1BE0667FE8219F9F73B349AB50AB51E7A7C92B979D32D9740101E1DB1A408CB0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\DmiProvider.dll.mui
Size 17KB
SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
MD5 b7252234aa43b7295bb62336adc1b85c
SHA1 b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f
SHA512 88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358
SSDEEP 192:C53q+0W6eHJr6dVD4hN2J63092HdHUcbR1b0apWuzWRvWt:g6eHJr6dVwH3J9bbvbHpfzWRvWt
TLSH
T1FD828F02A3FE4219F5F33B7469BA02751A7ABC92FDB9D61C1244211D1EB3E508DA1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\FfuProvider.dll.mui
Size 9KB
SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
MD5 dc826a9cb121e2142b670d0b10022e22
SHA1 b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9
SHA512 038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b
SSDEEP 192:/9Ulo7nI+5XnEhLADlDS+d4LfS65Xocb1CEdWcCWn:DLI+5XQL+d4LfS65XJBCEdWcCWn
TLSH
T17112CC0273FE551DF6F7BB786AB612210A3BBC95A879D71C0298111C1FE3A5088B1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\FolderProvider.dll.mui
Size 2KB
SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
MD5 22b4a3a1ec3b6d7aa3bc61d0812dc85f
SHA1 97ae3504a29eb555632d124022d8406fc5b6f662
SHA512 9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
TLSH
T11551DD4297F7062AF4EA0B3429B70A621A3E7D21AA66D32E8F00112D7C707049CB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\GenericProvider.dll.mui
Size 5KB
SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
MD5 d6b02daf9583f640269b4d8b8496a5dd
SHA1 e3bc2acd8e6a73b6530bc201902ab714e34b3182
SHA512 189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50
SSDEEP 48:ycW8d55p3lDPjLULeCH8C/FcWNlGHQlzQttIZWO9u8bK5WwHgw:l3lD3COWAcQLEWAeWwf
TLSH
T1CEB10405A7FF151AF4F72B3496B645A50B7FBC12B4B6D32E8B48111C1EA2A444CA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dismprov.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\000333E2-BEC3-41FF-BBE0-8F2560020610\en-US\dismprov.dll.mui
Size 2KB
SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
MD5 7d06108999cc83eb3a23eadcebb547a5
SHA1 200866d87a490d17f6f8b17b26225afeb6d39446
SHA512 9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
TLSH
T16A517D02D7FB062AF0EA0B3556F70A66177E7D12BA62932F8F00112C3870505ACA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

5120e835-ffcd-49f5-8000-61efc7d0736b.tmp

Path C:\Users\Admin\AppData\Local\Temp\5120e835-ffcd-49f5-8000-61efc7d0736b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62bcd053-15d4-4eea-83b0-61fcaad30cc7.tmp

Path C:\Users\Admin\AppData\Local\Temp\62bcd053-15d4-4eea-83b0-61fcaad30cc7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD66F7.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10cba30c-f2e1-47dc-aed8-b23d06f67132.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir9512_1132164236\10cba30c-f2e1-47dc-aed8-b23d06f67132.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir9512_1232668630\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 7f830d0e2506bd83de06a993472c86075ad73dc6d6abe271f8af5a59185ac09e
MD5 3b0d19c702fe1948e3a4518c2abc6a3a
SHA1 7a1b6fd19a0a264b434f84b259576493d95f0784
SHA512 1cc304e62a1dd8dc7c26f68724d5b5b1282217a3102e7dd277a8c379a44e38fd629652fc6a6240115571b51337005e80caf05d7f73bef19db8349f0c695eb869
TLSH
T1772129971B8ED47089E01BE76DEC8E2573B787CA87A0D0A5B34D9039480216D5B7E15D
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 362B
SHA256 bd77423df301d778551acf6b8955057881437a9cd1c928329745bbfd65731dac
MD5 fe8b38f561355bfa92ac28a1944da244
SHA1 cde83deb34f0c5f93a942f4ec2183b7177c491aa
SHA512 c5165b42cb3b70f89f0c18cfd81183506744917a72dd3ca5ce3b666c479cd1ac0c420c497fcb78bdb433ce559756a9c9467204c4edeca09dedd543318551593f
TLSH
T132E01A976354EBF683BC91797C795DF44BF28C24E6B82C2206CD4E890C7528762A7009
MD5 SHA1 SHA512 TLSH

Submit Download

SP_BD21B6DC8BDF40B684BF92CC8160C550.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_BD21B6DC8BDF40B684BF92CC8160C550.dat
Size 940B
SHA256 fe90e7eb996514ca42b62e72468d6987c9c228dde82a0c5a37acc0c0815e587e
MD5 ad6d30830b4680b242bdeb237df58a4b
SHA1 81d3a4f58179107c2a4e9d039a8f2d5ec6ef661a
SHA512 2137b4a64ee229b4f6c63575ed95c1d2fe16afd1434beb2c17412f62e99bc2df15aadc259044c332b046ebdf256439e4ed6a50504025bf5caef8c3fe5a445ef4
TLSH
T10F112B138CF00C1BC4672076031020D2D037413935DA3A0780186A47B78184A142681C
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 b641d05b81df3a393d98dd4ecfa05df983c04f0db048cef926cd4eb081ce02f6
MD5 91f8f4f21d5652522b5a8a7b75c0a660
SHA1 958b26544bac9ee82bbae5dc3ad9931afe57478a
SHA512 7d53b22f0210c48cf34c7fcccdb8c22e4981773e3797c8dcda9de372c3407a34a51c3206f62fa65a744157aaea8c2dbd55f2bc522eed8a33d7332985f19e9736
TLSH
T1182111802E830A17E4A4853A3679C365D770FE11BF00574E7789266F1D71820CE4FF2A
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 1f2fe7e16fd8e188565ea1615fb4ac26e8ade0935bda70dd23e0422cea8b774b
MD5 376642e0270dd92ce3e7de6ac5babb0b
SHA1 961b210018cc6c3b0ec01a1b254a0e9822766203
SHA512 05552ab7abac0b2e0ec5727ba4b014a56d27a1e63caf49d08e321a15e4689e55741f6d929e478376830a85f693064f2055b3651a5ede25e13da51930f8d2adc2
TLSH
T11C2130811E871E17D4A4953A36758352D770BE22BF00570EB789226F2C71920DE9FF2A
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 0b01005feba5a2d6291c6f0d4d9324b3d5c4b1e2ffeb622ea1c7b30d2de3278e
MD5 065ed6463aa1da8830992a1362048102
SHA1 cf08f93fdb059879a28e67894aba89669d0d5d8f
SHA512 45f1196070289e6fbabcf3277ef620768bbaca37a735049efa461327f836636bacc23d2e2c7dcbd68eed40046b7893b7e79728884720061dbf9fcd307dde5e33
TLSH
T1A65131801E974A1BE0F5943B39714B62E731FE127F04AB4E3689126E1D71D10DA8EB2B
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 f156ce8077fbb7868d17fbe3753035fa6d31be516cdc773e290562b9c7f788a6
MD5 ebf0923ae64b5745a365a8ea692252a3
SHA1 8a7fdaf6de37233a49af55f0e47a79fbc1014e5f
SHA512 a85ffe01fccad28102c57380f0d5d32055633b64a7b2cd82e33bcd11d3d5fc129a3369ea6928d3bf514f0aa6a30db3e3865cd853aec8a9431cdb79a78b686ccb
TLSH
T10E41ED422A8F1F17D184823B26758365CBB1BD02FF11630D7288256F5C71D60DF8EB2A
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bdc5858d875da4bbf010a61e5b42553125c3f1a10e9edda79eada1d6aced5b00
MD5 1d9aa2fe0c4819642305a01c79a635ef
SHA1 3eba2744430b4a6249e23d464b3cb141deb9249d
SHA512 50b74ec8c9b17a85f1cafcd9c729549a16c7413202ce7f935744aea3437f16623b643d267c56b3465d27576664f1dbdc9237f2f35e09ac129553a6d2ac3cd669
SSDEEP 192:l1d66JozGzgCl6mc0d03d+Ov5zboYZSNnyjxdQO+:jd66JozGzgC1j6boYZ0nyjS
TLSH
T185E10FA4E639863FC048027FCDA61B454F3A384A9C4E3F15319D644C2D572DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 72c5e6afae82ada7fd6a567388186b2d2654f4def7d6e8538f64687dbf35ba6c
MD5 6b2d0399e428d1efdf39b27c9ef17226
SHA1 e40ac0914d796ef03278a89477314a98f5eeb858
SHA512 c3f50794ddb0aaff62e6322223f8ca11bfb0ed2442d03bd0cbb07d7a0233b735503b7c668eff5ebf1cfb5b78ca9a1ff5667ae6d2cfcce61ab534776c73929437
SSDEEP 768:Tv1GOcc2GcmhuPDzsV8K+dMWx6bgbYDE/:5GOcVfDoO
TLSH
T11DE2FF84EB2E953FC41412BBDCA557002F79B88A591A2F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e1d56ea27d7a807b244fbc6f79f36f8ba5aec28e43b6d56e456179a8b79f8dbd
MD5 d9d02fd60cf3bac7abb01b6b4efa9d7a
SHA1 220d29daaed0b405b6aead67a29f5be81a1baee5
SHA512 54d110f697eac5d33339182cc667986d200f732114193c98c309d4f04c78cfb3464f56895ee9d3d23bc148d6dd17f8c16038b5b8fe20150ce1115dc4491a49a5
TLSH
T10321495C3AB84D6A9C87FA9C748602CE53D54F0B24C71D431E92DF8DCD81AE932AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

1f6ef983-e4a5-49fa-9126-cbda504d1330

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\1f6ef983-e4a5-49fa-9126-cbda504d1330
Size 886B
SHA256 7e1ec8aa0cf75eb76e92a41c3f9eebb372b8456f0198f2996362effeffae5ce7
MD5 8eb56f41a39c844066e116eed49b076b
SHA1 433290dff3d52c61e64c2cf32221c2ea5aaa77c5
SHA512 93d1e5ccea561ced1d350505a4f9e03a9e32286e08cac71060cf8f8044e87a92b5e71a7f420f766da031e2aa08d13c6d21b1eb18520a2fb8b6bada02bae9ee68
TLSH
T1A81100805638F9B1CC78D28FC6A2774647E43523C0CA4A147EA09F180DAE10E67BA607
MD5 SHA1 SHA512 TLSH

Submit Download

34d27a6d-8ea2-4b0d-a283-6227c9175284

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\34d27a6d-8ea2-4b0d-a283-6227c9175284
Size 235B
SHA256 dca3df2a254630334ab2afa237af11e68768918829e46b49835ca7813f12c4a5
MD5 0256600c0e7cdb8799b7ea9a0f86fdc1
SHA1 4a66c393bc260fcb9c7a33f9df55b4e534f08253
SHA512 d26d786cbef7568df82e2ed6182c898c7da630934b0006fcd683cca79aa6335f2eb43fae380f07082e4fc6030491fb96e7af596584697d6f13847666cb6cfbc5
TLSH
T1FDD0978028882B9E08144F02F0E0B9C270D98C33187C98209A520174DABDBC981A180A
MD5 SHA1 SHA512 TLSH

Submit Download

78065ea3-229a-465c-98cc-fce0c1c456f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\78065ea3-229a-465c-98cc-fce0c1c456f8
Size 883B
SHA256 62f64073654ff153cc755522d976278cd09472e5e0bc921ba5754e4a65ba717f
MD5 fb1a35640bfcb02c346d90aad1a0694f
SHA1 f9540191970a5cedcb08bbcbb53ebacbdfcf34e4
SHA512 fcc54bef370124cc2c7bc31bbd4fe26e7b7de4992abebeab7809d292dd5929b9b66ea357813daf34a3e1a7c173b95395207c49d562b6665d37fe702d07adb754
TLSH
T1891100806739BAB2CCACD24FC962334587E86623C0CA95243EA09E180D7E50E57BB207
MD5 SHA1 SHA512 TLSH

Submit Download

903519fa-cda5-4284-980d-69485cf6205e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\903519fa-cda5-4284-980d-69485cf6205e
Size 16KB
SHA256 fb80d6faba5f15d4ed6f14d8e0d01d41e29645e62635b6c4570aa7e14ca277cc
MD5 ff2f012aede5994edb80f5791db36a6b
SHA1 5a1e5cf64e4bba31f5d90dff1c9ecb9842901058
SHA512 3f016625eae12f4269339b8ee0716838fed114923856d1aae1b3e18c74edf568ddfe7f8de77838aa788f215e3f0db1ae2802e5aa1404e7f0c4937b58fcb835b9
SSDEEP 192:QidTR1YfJ4BnP7+YKXwqIZD1pKfebwxcUKDmU29mTZDd6NK9HXziudPSiBAbpSVb:TdTIfJ4tFPRimiK9HX5dPSiBAbYVb
TLSH
T19D72C956286055BA8691E368D4FC7FC3E6F528CF4C419FCA9BE4BD082DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9212fd72-b89e-478d-8094-594a5db0de6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\9212fd72-b89e-478d-8094-594a5db0de6f
Size 235B
SHA256 e538948451b39e38ba93d0fc8861971f188aade1c143c699616f59ee27da1fed
MD5 f9c0be1651bbb71a9f7d9ae1adb996cf
SHA1 d02b99def05432013f8e566d9de090e20e1c25bf
SHA512 0031aa4326def7b47fe32f6021f4b9596ff40f61771854592fc70fbe9a9755e336a9cf7a473bb7da9470ace33d9cbdc70c036d611c434c7b9adb03adf24afffe
TLSH
T1DED097E01498EB5C08148F07B0E068C231888E3328A86890C69000388EF8DC84222816
MD5 SHA1 SHA512 TLSH

Submit Download

c9e1a3ba-f5f3-4c73-9803-a45fa21dba38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\c9e1a3ba-f5f3-4c73-9803-a45fa21dba38
Size 2KB
SHA256 3f2f8be22d6faadce1ff00637b6a3a656dd68a27da040897d694e72d8fa00c27
MD5 4dd9a59c78675d353c718e6f84439575
SHA1 e40756a3d2126fcd1277b9667cf421737cd4978f
SHA512 24caecaab58cf93a48d4d585b40910cacd7b50923c904d9f6ac577cb52f6203c6296f63ae5e36e06e2516075100e1bc4176220d9db14eaa2e7f39ae8e986ba8b
TLSH
T1BB41515C76B85C369CCAE54CD582338E53B48A5340C62C837E91EF4C8DF668E23BA567
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\extensions.json
Size 16KB
SHA256 dfdc2ae8f3dd10d5e88de0a9147f3d44b1f491dad15e887604e5e4302d7a3638
MD5 ac22a55d73b4b5c7f9ad5585098621f6
SHA1 1dd478250a283cd403fa39beb5df2405ee39f062
SHA512 a4f3a6b3fd754dacdc63f0af966e1cc71e3f572ec87efbe7bd791efcfe9a989ee5df659226fa78494f95b3b918be01312b376000ed54536aed02fd5293af67a3
SSDEEP 384:ZkI4vvUmldv/8dhWX94zR96oWL4HwL4PZL4HiL4HTL4HsA4hX:6I4HRfMXm4T6j4S454w4/4h4d
TLSH
T1AD72401545448EB8294FA79AAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 6KB
SHA256 3646a0a13f9b540943b959417285de2263c701dce53409178d04e099083a2735
MD5 3eab7581ed8a2351b883685577961b94
SHA1 a2adfe13802a3454a4a1c8e1a137e709cfbc1202
SHA512 dae632cc07a81f7730b11a5b8d0399195d64b57987bcb51a4bf332c485cd5f38c016c6c2dc130a73a6e5c04ec897c38df5c72e225a738093b8517453a4939d73
SSDEEP 96:xHL0UTUrqGqNXfR+o1zSy8SSlIdv9jPanGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfR+oISSOl9vtc8gBw885aN
TLSH
T12CE11F7891088B6F64B6776C6C648C716AB2013B7BBF68D750B644C5051CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 6KB
SHA256 6f4e1b6cd81e7fcbbcedb63c8526ad8d3dbc73afa0c9ffb0c8a6a8064dafb741
MD5 7b001e5174bcaa51ccc551fa6e765d39
SHA1 1ea9a962618e3c63473907b9c7e765dd50203877
SHA512 985ba0c3eda7aa2549a014b8173707c11da40f3b9edaa2deb3f2ce3e7ce50d68634ac38ea5ede9c6e88c105ac037af9fb99e543fa2e53504a728dd0c21d88b37
SSDEEP 96:xHL0UTUrqGqNXfR+oObzSy8SSlIdv9jPanGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfR+ozSSOl9vtc8gBw885aN
TLSH
T10BE12F7891088B7F64B6766CAC6488316AB2013B7BBF68D750B644C5051CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 7KB
SHA256 d981e8a9101bc89c24a8086b6e144bf847f9d10bbc7520a36eb38d18d0a2d27c
MD5 9e79790cb712f17ddf253204abc45b6a
SHA1 5970e56cd456597801df9f8fcc4f3d89a4ad46d4
SHA512 508ddf205be940506440712873c0b3f6af18361f1f578a2ccb80a0a4bf03c3831815ccae339e2188bf390beeb5ade42d59779ecc02a8a42c692625dca72a209d
SSDEEP 96:xHL0ZTUrqGqNXfi+oObzSy8SSlIdv9jPanGRWRGDtcXMZSBw888u8L4cnkVtOJP:ePRNXfi+ozSSOl8Ratc8MBw88jaN
TLSH
T1A0F12E385504CB7F64B6366CAC6488716AF2013BBBBF68C750BA44C5051CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs.js
Size 6KB
SHA256 34d28048457c6d8c2f2370d298d406e712f2cd0533bf9bf5fb6cd7cefd335021
MD5 9db7620ee3b7610913189ce6c86828b6
SHA1 d33f1fdbe4eb5eeadf7847827f0f2349d7700916
SHA512 6dfa284610232c0f65198206e427b4bcdac04c6ac5edbbcfd393eeba04329338be1a2eaeefe962cbf515f89fabffd5a12e9a45cc259f175d3afdf6397962d8a8
SSDEEP 96:xHL0UTUrqGqNXfRbS1zSYSSlSdv9jPnGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRbSZSSf9vtc8gBw885aN
TLSH
T1B3E11F7891488F7F64B677AC6C6488316AB2013B7BBF68D750B654C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 958dfe471889dc12f31e5358a43e6b4a46311696dd9e96ef5cfd4cf8286e2f98
MD5 cb8b56381f76824dd79b778222a5381d
SHA1 6e629165f3a2b26cea3fe81c3ae8c3fec015e423
SHA512 ddc95547bd942c948c331ebd556fa48f6db4208adfc6f815682f03dbcfd2b1ef4b15816c91ac09ed042db8679009d5f22b3d0ab9d4b940a6afdced9224b0e479
TLSH
T1CE21E74A7EAF0CF52920D29650CA8BD99BA090730594F4F0D489981050CC90F779D367
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 2ea6955b0fbf290ee93756e01504e7316fa36546e77af5a7cf83d23c6b39d7a7
MD5 4d3c5afec5e3eb81cd84f26d031c0530
SHA1 ec9385f05401b6bd790be0fb78fe462891d2b732
SHA512 76e11346c0837214a91941f77770de401748b5612780977b9ae64ef4379dfa25dd6e491ccaa690aaf9d598b91b6e2df83aa4a407bf63f7974ea16c39c8809eea
SSDEEP 49152:Q9yWkSn/X1Xejy2D3/YbFCRk4lId0MRGQOaCTzHWjv68TW9wMrt5qKFxaCJJPuqg:AAJWqq74dNJXPh8
TLSH
T147765BE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Welcome Scan.jpg

Path C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg
Size 504KB
SHA256 aac4ac970ec47cd95dc7c65d7d38d29c1f948be24d5dad1d5aa21053125367c7
MD5 73d4281e46a68222934403627e5b4e19
SHA1 0f1c29cea7ea24ebb75c95114e0b0d26438e1d39
SHA512 bb7aad10e5accd3f5c0f6b2968973034a2f7c2523401eb234b2de0cdad2dc13f4fd58d08ece94ec06420a52b3d371ba832f8fb4741f48799703bdf32a4daf555
SSDEEP 12288:lhozPuhM95uqkMK+FdBDSHtW+XKJE1D0tvp6HPlktXlDyRZs:IPuhHG13gWHO1ov4+8s
TLSH
T1CBB423309E0F1CB6F958513274B34603ABE35B537698FD54B43E0B2AF3992528EE5709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 c8222139b761f707253a25da5987a95039911221d5c6dec2cc904219b7b7e4c0
MD5 83fce127466c4a398f91cb2e8c1cdfbc
SHA1 6a7f61b7c920b493f3d3fbde995a044e444ae6cb
SHA512 a71055f06cde928f12aa2b6f0b16d4d2454fc86c86e1d1c3a2befa49d9d9a0b6f22ed963fa7c92c99486dea986f4fb5e79fc8038ab9479da9965e1eaed2523d4
SSDEEP 3072:YxWHF47dHSe4xgvHRu5vvU3kmRDWW3T81QdBeHW3TwcgX9wgXp4Xpndr7adkl2EI:Yigc80hXr8HFJNrtFZqoHPUNIvdER
TLSH
T10AA5CF3D23FF09307585840375795BAC51C736ABAF89F7143A3FD626D3C6A898A492C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1400-2552-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/1400-2556-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/2368-1-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/2368-6-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/2368-0-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/2368-5-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/2368-2-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/2368-3-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/2368-4-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/3052-2201-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2065-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2531-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2052-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2094-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2492-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2477-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2129-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2586-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2288-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2182-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/3052-2123-0x000001CA66D80000-0x000001CA66D81000-memory.dmp

Download

memory/4712-2045-0x000000001CF60000-0x000000001D446000-memory.dmp

Download

memory/6036-449-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/6036-446-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7448-767-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7448-804-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7616-2632-0x0000000004160000-0x0000000004170000-memory.dmp

Download

memory/7616-2430-0x0000000003C00000-0x0000000003C10000-memory.dmp

Download

memory/7616-2631-0x0000000003C00000-0x0000000003C10000-memory.dmp

Download

memory/7616-2079-0x0000000002C00000-0x0000000002C10000-memory.dmp

Download

memory/7632-655-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7632-656-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7888-671-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/7888-674-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/8188-1987-0x00007FFF35300000-0x00007FFF35331000-memory.dmp

Download

memory/8188-1986-0x000000001D090000-0x000000001D0C1000-memory.dmp

Download

memory/8848-2105-0x0000021B390D0000-0x0000021B390D1000-memory.dmp

Download

memory/8848-2099-0x0000021B390D0000-0x0000021B390D1000-memory.dmp

Download

memory/9460-2615-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/9460-2608-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/9484-2616-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/9628-2172-0x0000018C79AA0000-0x0000018C79AA1000-memory.dmp

Download

memory/9628-2179-0x0000018C79AA0000-0x0000018C79AA1000-memory.dmp

Download

memory/9804-2653-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9804-2659-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9804-2658-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9804-2657-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9804-2652-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9804-2651-0x0000022D152F0000-0x0000022D152F1000-memory.dmp

Download

memory/9844-2630-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/9844-2628-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

memory/9956-2245-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2197-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2196-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2198-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2199-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2248-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2247-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9956-2246-0x00007FFF49D10000-0x00007FFF49D20000-memory.dmp

Download

memory/9972-2583-0x0000000000660000-0x00000000006D4000-memory.dmp

Download

memory/9972-2647-0x0000000036CE0000-0x0000000036CF0000-memory.dmp

Download

memory/9972-2594-0x0000000006240000-0x000000000628E000-memory.dmp

Download

memory/9972-2588-0x0000000005440000-0x0000000005452000-memory.dmp

Download

memory/9972-2587-0x0000000005E90000-0x00000000061E4000-memory.dmp

Download

memory/9972-2585-0x0000000005CD0000-0x0000000005E88000-memory.dmp

Download

memory/9972-2584-0x0000000005040000-0x000000000504A000-memory.dmp

Download

memory/9972-2629-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/9972-2609-0x0000000008800000-0x0000000008822000-memory.dmp

Download

memory/9972-2597-0x0000000006FA0000-0x0000000007316000-memory.dmp

Download

memory/9972-2634-0x0000000007E30000-0x0000000007E3E000-memory.dmp

Download

memory/9972-2633-0x0000000007EA0000-0x0000000007F0C000-memory.dmp

Download

memory/9972-2593-0x00000000065B0000-0x000000000696A000-memory.dmp

Download

memory/9972-2648-0x0000000036CE0000-0x0000000036CF0000-memory.dmp

Download

memory/9972-2596-0x0000000006970000-0x0000000006C12000-memory.dmp

Download

memory/10076-2279-0x000000006FCB0000-0x000000006FCC0000-memory.dmp

Download

memory/10076-2274-0x000000006FCB0000-0x000000006FCC0000-memory.dmp

Download

memory/10076-2383-0x000000006FCB0000-0x000000006FCC0000-memory.dmp

Download

memory/10076-2273-0x000000006FCB0000-0x000000006FCC0000-memory.dmp

Download

memory/10076-2272-0x000000006FCB0000-0x000000006FCC0000-memory.dmp

Download

memory/10076-2465-0x0000000000A00000-0x0000000000A30000-memory.dmp

Download

memory/10076-2468-0x00000000058A0000-0x0000000005E44000-memory.dmp

Download

memory/10076-2470-0x0000000005490000-0x0000000005522000-memory.dmp

Download

memory/10076-2489-0x0000000005450000-0x000000000545A000-memory.dmp

Download

memory/10196-2598-0x00007FFF473B0000-0x00007FFF473C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads