7246feb461275f99a389d6f59d23bb0d33c73e8c091ba20c91f96786168f57d6

Analysis

user interaction
yes
max time kernel
19s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alle-programme-oeffnen_v5.bat
Size 1KB
Sample260930-ss2flabd94
SHA256 7246feb461275f99a389d6f59d23bb0d33c73e8c091ba20c91f96786168f57d6
MD5 4bd7438b7e7579df833a8deeff28f71a
SHA1 848c24851c10f1a5e32e9e25252f0ce51959c1aa
SHA512 56d32897c6e4e7f8b5578f56b1aa14d795b86e97b4453e1aa3358c827baf6fb12db198afbe8dd8364e14f7e826ec316780b6e3d778ebafbf10e3163f3e6ad2ea
TLSH
T119213F07218A6203AFB3652547069BACBE1C0249913563C330C689EBF817967DBDDD8A
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery execution persistence spyware

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
556	RdrServicesUpdater.exe

Loads dropped DLL 29 IoCs

pid	Process
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
2924	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_history_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\sl-si\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\images\Info.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\inline-error-2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\root\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\home\js\nls\en-gb\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\icons_retina.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\@1x\[email protected]	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\hr-hr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\js\nls\root\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\welcome-2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\css\main-selector.css	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\check-mark-1x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\WelcomeCardRdr.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\app-center\js\nls\de-de\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_filterselected-focus_32.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\send-for-sign\images\themes\dark\progress.gif	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\images\sat_logo.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-It.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\it-it\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\images\themes\dark\s_radio_unselected_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\activity-badge\js\nls\sl-sl\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\images\CompleteCheckmark.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_filterselected-hover_32.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\nl-nl\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\ar_get.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\welcome.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\js\nls\de-de\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_duplicate_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer-select\css\main-selector.css	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\images\themes\dark\new_icons.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\images\themes\dark\bun.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\images\share_icons.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\js\nls\zh-cn\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_link_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_filter-default_32.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\core\dev\nls\root\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\send-for-sign\images\themes\dark\caution.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js	RdrServicesUpdater.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5912e0.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912e4.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912e8.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912f0.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912fa.HDR	msiexec.exe
File created	C:\Windows\Installer\e591304.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E9B.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A4F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5912db.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912e6.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912f0.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912fb.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591304.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3573.tmp	msiexec.exe
File created	C:\Windows\Installer\e5912d8.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912f5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591300.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591307.HDR	msiexec.exe
File created	C:\Windows\Installer\e591308.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912f2.HDR	msiexec.exe
File created	C:\Windows\Installer\e591301.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI118E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14ED.tmp	msiexec.exe
File created	C:\Windows\Installer\e5912d6.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912e8.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912eb.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912ee.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591308.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912e3.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF19.tmp	msiexec.exe
File created	C:\Windows\Installer\e5912e7.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912e9.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912ee.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912fd.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591301.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912f4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912f6.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\e5912dc.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912dd.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912e1.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2ACD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1082.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912d5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591303.HDR	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico	msiexec.exe
File created	C:\Windows\Installer\e5912d4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912fb.HDR	msiexec.exe
File created	C:\Windows\Installer\e591300.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e591302.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3829.tmp	msiexec.exe
File created	C:\Windows\Installer\e591302.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912d8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912e1.HDR	msiexec.exe
File created	C:\Windows\Installer\e5912fe.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5912eb.HDR	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6008	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7760	cmd.exe
7148	SnippingTool.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7132	chrome.exe
6528	msedge.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\HELPDIR\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler\CurVer\ = "PDFPrevHndlr.PDFPreviewHandler.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3F1-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDBookmark"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\NumMethods\ = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xdp+xml\Extension = ".xdp"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\PDFFile_8.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\shell\Printto\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" /t \"%1\" \"%2\" \"%3\" \"%4\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithList\Acrobat.exe\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ = "PSFactoryBuffer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{7CD06992-50AA-11D1-B8F0-00A0C9259304}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ = "IBitmapProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroBroker.Broker\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\ = "URL:Acrobat Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\XDPFile_8.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document.DC\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B744CAF070E41400\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf\OpenWithList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ = "IAcroAXDoc"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document.7\shell\read\Command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Read\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\ = "AcroExch.acrobatsecuritysettings"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ = "IAdobeInitializeWithFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroBroker.Broker.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\PDXFileType\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.api	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\shell\Open\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\BrowseInPlace = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.XDPDoc\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\ = "Adobe Acrobat Security Settings Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.fdf\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\ = "Read"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xdp\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\ = "URL:Acrobat Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods\ = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\AuxUserType\3\ = "Adobe Acrobat 8.0"	msiexec.exe

Runs regedit.exe 1 IoCs

pid	Process
8932	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4124	MsiExec.exe
4124	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6008	cmd.exe
Token: SeIncreaseQuotaPrivilege	6008	cmd.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	6008	cmd.exe
Token: SeAssignPrimaryTokenPrivilege	6008	cmd.exe
Token: SeLockMemoryPrivilege	6008	cmd.exe
Token: SeIncreaseQuotaPrivilege	6008	cmd.exe
Token: SeMachineAccountPrivilege	6008	cmd.exe
Token: SeTcbPrivilege	6008	cmd.exe
Token: SeSecurityPrivilege	6008	cmd.exe
Token: SeTakeOwnershipPrivilege	6008	cmd.exe
Token: SeLoadDriverPrivilege	6008	cmd.exe
Token: SeSystemProfilePrivilege	6008	cmd.exe
Token: SeSystemtimePrivilege	6008	cmd.exe
Token: SeProfSingleProcessPrivilege	6008	cmd.exe
Token: SeIncBasePriorityPrivilege	6008	cmd.exe
Token: SeCreatePagefilePrivilege	6008	cmd.exe
Token: SeCreatePermanentPrivilege	6008	cmd.exe
Token: SeBackupPrivilege	6008	cmd.exe
Token: SeRestorePrivilege	6008	cmd.exe
Token: SeShutdownPrivilege	6008	cmd.exe
Token: SeDebugPrivilege	6008	cmd.exe
Token: SeAuditPrivilege	6008	cmd.exe
Token: SeSystemEnvironmentPrivilege	6008	cmd.exe
Token: SeChangeNotifyPrivilege	6008	cmd.exe
Token: SeRemoteShutdownPrivilege	6008	cmd.exe
Token: SeUndockPrivilege	6008	cmd.exe
Token: SeSyncAgentPrivilege	6008	cmd.exe
Token: SeEnableDelegationPrivilege	6008	cmd.exe
Token: SeManageVolumePrivilege	6008	cmd.exe
Token: SeImpersonatePrivilege	6008	cmd.exe
Token: SeCreateGlobalPrivilege	6008	cmd.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeDebugPrivilege	2924	MsiExec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	cmd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1640	msiexec.exe
2924	MsiExec.exe
4124	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 4980	6008	cmd.exe	91
PID 6008 wrote to memory of 1736	6008	cmd.exe	92
PID 1640 wrote to memory of 2924	1640	msiexec.exe	94
PID 1640 wrote to memory of 4124	1640	msiexec.exe	95
PID 1640 wrote to memory of 556	1640	msiexec.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\alle-programme-oeffnen_v5.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Acrobat Reader DC "
  2⤵
  PID:4980
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1736
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
  2⤵
  PID:2212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:5952
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=642BBEA034A56F59BDCAE6F260C07C78 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AA1D79F9988F7AA1CAD5117B4DED6B2A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AA1D79F9988F7AA1CAD5117B4DED6B2A --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4BB0A0556449C98D42A25BFA279F726E --mojo-platform-channel-handle=2472 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:7560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=010216C0CB056337D1543EDDFD959BFB --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:8248
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2AFCACB94B8358A09F3558E5AE20DD95 --mojo-platform-channel-handle=1900 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:8916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Calculator "
  2⤵
  PID:4592
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5672
- C:\Windows\system32\win32calc.exe
  "C:\Windows\system32\win32calc.exe"
  2⤵
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Excel "
  2⤵
  PID:2784
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:3424
- C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Firefox Private Browsing "
  2⤵
  PID:4464
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:2956
- C:\Program Files\Mozilla Firefox\private_browsing.exe
  "C:\Program Files\Mozilla Firefox\private_browsing.exe"
  2⤵
  PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    PID:4584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
      4⤵
      PID:1440
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {aeb922ed-a456-4839-8e0e-1ce0da85168e} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {f533cdc3-d202-4e57-abde-a1e746276c00} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4052 -prefsLen 27274 -prefMapHandle 4056 -prefMapSize 270279 -jsInitHandle 4060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4068 -initialChannelId {c43ea314-b94b-4c14-9020-0200576bbbc1} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        
        PID:5772
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4224 -prefsLen 27274 -prefMapHandle 4228 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {539abd79-40da-45d8-a80c-7793293f920c} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:3644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 34773 -prefMapHandle 4520 -prefMapSize 270279 -jsInitHandle 3100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3252 -initialChannelId {f84724db-2e72-4b46-8345-05507c8093e1} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        
        PID:2620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5284 -prefsLen 35010 -prefMapHandle 5288 -prefMapSize 270279 -ipcHandle 5300 -initialChannelId {cbc153ce-e590-481a-b2e4-35a55bb831c3} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        
        PID:6388
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3324 -prefsLen 35704 -prefMapHandle 4668 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {dc59eead-b52a-45b0-b815-645d43ebf500} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        
        PID:12032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5920 -prefsLen 35704 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {1ed339bd-a7da-453f-875f-312b6caba343} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        
        PID:11268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6032 -prefsLen 35704 -prefMapHandle 6028 -prefMapSize 270279 -jsInitHandle 6024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6016 -initialChannelId {478002bc-8b5b-4496-b662-b4173a87ec13} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        
        PID:11364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Firefox "
  2⤵
  PID:3260
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:3176
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Google Chrome "
  2⤵
  PID:2916
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff99a61c728,0x7ff99a61c734,0x7ff99a61c740
    3⤵
    PID:616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,13851627387979413358,2811509629229539376,262144 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
    3⤵
    PID:7124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,18440177515127490663,3265691738625805391,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,17310863124448728455,7372166990433327052,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
    3⤵
    PID:7140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,6162548558055536673,1330073621651198209,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:7164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,1308479778141277327,4413305852586823876,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:7156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,321571368847674803,12123556950088004385,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,12503841309160546245,2937735205184999615,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:3364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,16668908203860677884,9704986870941221681,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:9092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,9910407294541511201,17383514876553708306,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,12287135786783816958,15893647772321367398,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:6444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,9096528605360883855,1870046606384548794,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:10112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5772,i,17263859115495544067,5416718920608016354,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:10120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6080,i,5477252084519866064,17619547464982513816,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:9672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6048,i,2015276795672634682,14206155008606090443,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5892,i,10654904918324942838,10434200608185802084,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:8736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6276,i,10991649428506383013,17924533378557248840,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:11008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6224,i,5936217072242274026,11597614044634934576,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:9512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,10594673217008458797,13268565463838321348,524288 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:11736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6252,i,12093340304447821850,1178006338652478008,2097152 --field-trial-handle=2472,i,13194464135057669866,15110241653455766762,262144 --variations-seed-version --mojo-platform-channel-handle=1120 /prefetch:1
    3⤵
    PID:11708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Microsoft Edge "
  2⤵
  PID:6564
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff98d25c188,0x7ff98d25c194,0x7ff98d25c1a0
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14469863943458750581,7000631838332355791,262144 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4941368836122981739,13819829934373229545,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,14411923290115508995,43112541502589798,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
    3⤵
    PID:6892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,17730450405953414374,13106896975392323394,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,11850679331669870837,7637606213971438574,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,1757550669821067425,9753402126696876651,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,6615688630620865651,4751207130647876946,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,1574546880646878053,4201109458714824806,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,30102996737764375,1913229187620160420,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:7444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10907948515607946060,6056618677498998528,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:7452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,449936511644140663,17379854982564892789,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:10184
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,805338464162911368,11453541703623203784,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,12339413602739608493,14211930099889374711,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
    3⤵
    PID:9280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16461891666050846111,873194841733758885,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:9284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,805338464162911368,11453541703623203784,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:8044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7574361352515258464,11961667584318128528,524288 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:14
    3⤵
    PID:10272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6232,i,9519700971237745493,3469851511843716438,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:7332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6448,i,15434224609542296898,17869689787131604605,2097152 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
    3⤵
    PID:11016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,2087149758945474370,9185900861522183549,262144 --field-trial-handle=2752,i,2148058880437114718,4801417220012497682,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:10
    3⤵
    PID:10608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Notepad "
  2⤵
  PID:2696
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:4764
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:6212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo OneNote 2016 "
  2⤵
  PID:6940
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6220
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"
  2⤵
  PID:8116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Outlook "
  2⤵
  PID:7708
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7312
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Paint "
  2⤵
  PID:8072
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7768
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe"
  2⤵
  PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo PowerPoint "
  2⤵
  PID:6268
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:6664
- C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
  2⤵
  PID:7240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Snipping Tool "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7760
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7776
- C:\Windows\system32\SnippingTool.exe
  "C:\Windows\system32\SnippingTool.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Word "
  2⤵
  PID:2016
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8028
- C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
  2⤵
  PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 7-Zip File Manager "
  2⤵
  PID:7940
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:3084
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe"
  2⤵
  PID:8380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 7-Zip Help "
  2⤵
  PID:8404
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Remote Desktop Connection "
  2⤵
  PID:8448
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8460
- C:\Windows\system32\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:8524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Steps Recorder "
  2⤵
  PID:8540
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8548
- C:\Windows\system32\psr.exe
  "C:\Windows\system32\psr.exe"
  2⤵
  PID:8588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows Media Player Legacy "
  2⤵
  PID:8620
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8628
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
  2⤵
  PID:8668
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    PID:8720
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      PID:8804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Character Map "
  2⤵
  PID:8772
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8780
- C:\Windows\system32\charmap.exe
  "C:\Windows\system32\charmap.exe"
  2⤵
  PID:8820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Component Services "
  2⤵
  PID:8960
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8968
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\comexp.msc"
  2⤵
  PID:9156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Computer Management "
  2⤵
  PID:9208
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:3300
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
  2⤵
  PID:8348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo dfrgui "
  2⤵
  PID:8732
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8792
- C:\Windows\system32\dfrgui.exe
  "C:\Windows\system32\dfrgui.exe"
  2⤵
  PID:9108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Disk Cleanup "
  2⤵
  PID:8252
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8280
- C:\Windows\system32\cleanmgr.exe
  "C:\Windows\system32\cleanmgr.exe"
  2⤵
  PID:8416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Event Viewer "
  2⤵
  PID:8756
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8996
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
  2⤵
  PID:8864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo iSCSI Initiator "
  2⤵
  PID:9092
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9024
- C:\Windows\system32\iscsicpl.exe
  "C:\Windows\system32\iscsicpl.exe"
  2⤵
  PID:8296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Memory Diagnostics Tool "
  2⤵
  PID:8808
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:120
- C:\Windows\system32\MdSched.exe
  "C:\Windows\system32\MdSched.exe"
  2⤵
  PID:8480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ODBC Data Sources (32-bit) "
  2⤵
  PID:9256
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9264
- C:\Windows\syswow64\odbcad32.exe
  "C:\Windows\syswow64\odbcad32.exe"
  2⤵
  PID:9292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ODBC Data Sources (64-bit) "
  2⤵
  PID:9312
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9324
- C:\Windows\system32\odbcad32.exe
  "C:\Windows\system32\odbcad32.exe"
  2⤵
  PID:9472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Performance Monitor "
  2⤵
  PID:10000
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10084
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /s
  2⤵
  PID:10076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Print Management "
  2⤵
  PID:10108
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1628
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\printmanagement.msc"
  2⤵
  PID:9236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo RecoveryDrive "
  2⤵
  PID:9776
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9944
- C:\Windows\system32\RecoveryDrive.exe
  "C:\Windows\system32\RecoveryDrive.exe"
  2⤵
  PID:9972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Registry Editor "
  2⤵
  PID:4952
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:1908
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:8932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Resource Monitor "
  2⤵
  PID:9632
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10016
- C:\Windows\system32\perfmon.exe
  "C:\Windows\system32\perfmon.exe" /res
  2⤵
  PID:9800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Security Configuration Management "
  2⤵
  PID:5288
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8884
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\secpol.msc" /s
  2⤵
  PID:9900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo services "
  2⤵
  PID:9496
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7316
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
  2⤵
  PID:9504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo System Configuration "
  2⤵
  PID:10028
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9632
- C:\Windows\system32\msconfig.exe
  "C:\Windows\system32\msconfig.exe"
  2⤵
  PID:10004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo System Information "
  2⤵
  PID:7344
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:4744
- C:\Windows\system32\msinfo32.exe
  "C:\Windows\system32\msinfo32.exe"
  2⤵
  PID:9892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Task Scheduler "
  2⤵
  PID:9736
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8316
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
  2⤵
  PID:8856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows Defender Firewall with Advanced Security "
  2⤵
  PID:4744
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:5024
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
  2⤵
  PID:7696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo About Java "
  2⤵
  PID:6552
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:9584
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe" -tab about
  2⤵
  PID:9888
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel -tab about
    3⤵
    PID:7024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Check For Updates "
  2⤵
  PID:10248
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10260
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe" -tab update
  2⤵
  PID:10416
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel -tab update
    3⤵
    PID:10428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Configure Java "
  2⤵
  PID:10704
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10720
- C:\Program Files\Java\jre-1.8\bin\javacpl.exe
  "C:\Program Files\Java\jre-1.8\bin\javacpl.exe"
  2⤵
  PID:10864
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xbootclasspath/a:"C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Djdk.disableLastUsageTracking -Dsun.java2d.dpiaware=true -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel
    3⤵
    PID:10884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Database Compare "
  2⤵
  PID:10936
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10944
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE"
  2⤵
  PID:11068
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE"
    3⤵
    PID:11144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Office Language Preferences "
  2⤵
  PID:11076
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:11104
- C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
  "C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE"
  2⤵
  PID:7768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Office Upload Center "
  2⤵
  PID:7368
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:8076
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE"
  2⤵
  PID:11172
- - C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\MSOUC.EXE"
    3⤵
    PID:11084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Spreadsheet Compare "
  2⤵
  PID:9512
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:11192
- C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
  "C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" "C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE"
  2⤵
  PID:7076
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE"
    3⤵
    PID:10640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Telemetry Dashboard for Office "
  2⤵
  PID:10704
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10392
- C:\Program Files\Microsoft Office\root\Office16\msotd.exe
  "C:\Program Files\Microsoft Office\root\Office16\msotd.exe"
  2⤵
  PID:11024
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryDashboard.xltx" /x
    3⤵
    PID:10468
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:11224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Telemetry Log for Office "
  2⤵
  PID:1608
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10364
- C:\Program Files\Microsoft Office\root\Office16\msoev.exe
  "C:\Program Files\Microsoft Office\root\Office16\msoev.exe"
  2⤵
  PID:10860
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /t "C:\Program Files\Microsoft Office\Root\Office16\1033\TelemetryLog.xltx" /x
    3⤵
    PID:10268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Task Manager "
  2⤵
  PID:10400
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10604
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  PID:6824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Documentation "
  2⤵
  PID:2948
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.videolan.org//doc/
  2⤵
  PID:10348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Release Notes "
  2⤵
  PID:8628
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VideoLAN\VLC\NEWS.txt
  2⤵
  PID:11104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VideoLAN Website "
  2⤵
  PID:7700
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:7844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.videolan.org/
  2⤵
  PID:11248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VLC media player - reset preferences and cache files "
  2⤵
  PID:10260
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10348
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --reset-config --reset-plugins-cache vlc://quit
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VLC media player skinned "
  2⤵
  PID:9044
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:4068
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" -Iskins
  2⤵
  PID:10148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VLC media player "
  2⤵
  PID:11560
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:11600
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe"
  2⤵
  PID:11852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows PowerShell ISE (x86) "
  2⤵
  PID:12080
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:12092
- C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
  2⤵
  PID:12224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Windows PowerShell ISE "
  2⤵
  PID:12240
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:12248
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
  2⤵
  PID:11252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Administrative Tools "
  2⤵
  PID:11416
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:11544
- C:\Windows\system32\control.exe
  "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
  2⤵
  PID:11840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo File Explorer "
  2⤵
  PID:7560
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:10740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo OneDrive "
  2⤵
  PID:11352
- C:\Windows\system32\findstr.exe
  findstr /i "uninstall deinstall entfernen remove setup readme hilfe help lizenz license"
  2⤵
  PID:11388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14F5D2C21BEC93DD108327E565D7E479
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27D9A7D022781E127FA3B10A045DA5EF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4124
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20069 19.010.20069.0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:8620

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:9132

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:8844

C:\Windows\system32\Defrag.exe
C:\Windows\system32\defrag.exe
1⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:9868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:10144

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 11144 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:11176

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 11144 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:11196

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 10640 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:10608

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\mavinject32.exe" 10640 "C:\Program Files\Microsoft Office\root\Client\AppVIsvSubsystems32.dll" 1
1⤵
PID:10576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:620

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:7232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:12108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591309.rbs

Path C:\Config.Msi\e591309.rbs
Size 682KB
SHA256 b6e1efe0b9dbe7fadba570ebc4aa171ab0b14cfef225459c67e65e7b3fa20294
MD5 aea9c192b42fa1f73e44a557c6e9f5f4
SHA1 ad80c21395183672ee4d03607b6cf8b997e66cd8
SHA512 8cb3fe85a98fbdfcddc49786db92482a123720bffff0f3105a5e2e62d5ae16aefb9ee5f2b0105f9bd7ff0122dcd00e050ee00209e8fed69f409e31f78fa68e6a
SSDEEP 6144:JP8N0LW3qa54J725UZnEuru4dtN5dHak+KNlA0ZBoWENFw2IzuJAgXrCUlZy1O9a:18mLPa5S72qVRLHak58py0h7S
TLSH
T163E4CB4277C09561E0FB1B70E97B5F153B36FDB457B2820F824C812A4DA27417E6AF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 24.8MB
SHA256 efe7823887f5366e78a53b1992e65afca89f4c0149c54d5e4c0d746c6d4c8ab9
MD5 1248c72c9c64a59abaa6b7c3d23f90a9
SHA1 b4c3778574c39f7e64bcc3b7b0e42c577e937504
SHA512 6e3001c2f282b00430d15d8359be1ee1d3541b49c1fcdc02f0dc433ea0b470b52387772866f08ebad854f28b6ff1123e9015d25916ba91aea014fb96821e6b3e
SSDEEP 393216:zwChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9Bz:kC1rq2/r+bqAzMmIn0BuTFE82z
TLSH
T108472274861DA679FD3E82F51DCF02A688CA4DF15632F8C5F9925E384E2722037B5B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s_remove_18.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_remove_18.svg
Size 711B
SHA256 94f76b160568e3705f1e0d2d6ff3ee6927bd812032498d373bbcc516af2864f7
MD5 8bb62cfad37334a15129a0da2091d472
SHA1 a9f223eb2bd355c8cbf7d17db501db834f39cb6c
SHA512 da08c15accffeca9c1ec985899ebf234aa881546dfb80862c72bfe206dfbf92772582ff87c0636ca0a4cdeeb03635de7a24aecacba86e22683a1d689724d6dab
TLSH
T1060173D7543F437942428FB82474F5C0358510B2BECC4E04E420F550ABD99FD5D789EA
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\rhp_world_icon.png
Size 445B
SHA256 42c312aa2a038ca54e9a6fe4bad8c9c044c35b4c5f421496f289c00c957d7591
MD5 ed537606a39879a091a8c085cf95ff38
SHA1 86c73d85094efbfdcd80abf119f03b64a71cbd0f
SHA512 fc331c2e1ec84a6a83b51f365484033b3069d73c5987094cf526c45a92c3297df22fe2a35ec20382ed4d563ee604ecbdbdf17fb735f7e0118ab444b4d5db8e9d
TLSH
T189F0A3DEE484CD29C75AB329976D0D31544B534B9100558B06364761117477F49717E3
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\rhp_world_icon_2x.png
Size 611B
SHA256 71039e6370f68913e67cb8451d3127c22d3e1045ca644e4dc9821e9f6f6899aa
MD5 37d179c947c13f64b7b6356f57441032
SHA1 9d1c1bd0c370336c229baeb2cd7f80d7b3cf4d0a
SHA512 3034a8b9694bbde20be0f7fa2596fbca8fd3f1e45810b15a5cb1a2bc6f4ef852afc36639a56f82a4e582d74684724d5c4ee43cbf5e33c94c6cf00b3c059757bf
TLSH
T131F0028EADC5E58C8A511366479E4D60585D270F201435B59D69CBA151F063828D43D3
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\rhp_world_icon_hover.png
Size 388B
SHA256 8bcf53efcb1b630087d4cfcedf5e48a7abaa9c71dd13745eedfd2c7cfa6827f5
MD5 6d8f7e9751f955452a9ceeb815456035
SHA1 e6903b2ec0f2c5632d4288f88d993d4a41f04527
SHA512 c869a94a224bce8ed553f5a86ffdea6d8a279e06a1c060b311cc52e4538b89e07fc0a4a76f85a28e2f62e8629a7c67101e990cc12bef2d0e2d6d7d3c1d4d7d90
TLSH
T18EE0C0D0A174085D5764A1371964319155B73395E08900D516DF85B025AC1D4E5C0573
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 87da831caa04bd303918a32265830ff97648dc8adc18881ba14d1cc1d28cde85
MD5 f364ee8508831e375004ac82b924efd5
SHA1 b04bc510ef53760bdd22ce0dd9d2e2f248c16df7
SHA512 399b2da615c0373214e3cf421f502fd0de02bdb9473da644e9f23df9ea7fc792da7d36bde61a456c2451276f74877232c8bedbe55e57098c1ffd13719206bac3
TLSH
T15AF00EDDD2E8717EFFB2503981697390A46AB0E2D1A0D0BAC4FDC8E132424F552D9B72
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 854a09f1f875a3a2e6566c593af465c9c8a3aa9b9112eb755bb09cee76224a63
MD5 39be6b8bd8dce3ff5a1c20ac41ba993f
SHA1 a49d8a0c769601bf922c8aa1673bfd3a92d67855
SHA512 9fd5d4f02aa9d24ce9591ac0542d0abadf2b26208c3043220d2a0f036298199131ad804f9be20c6cc67f39e2921eebec65efb3a1e435ee7318fd8591fcc2fa2a
TLSH
T13AE028C0B1742C4A572492372A7411C058B703D5E08D01D557CFC5F82DEC4D4F6C4573
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 bfef65c62bfc309f698e8e0b999edfc06ad272b87d805f183551c43f08d704a9
MD5 b34c8c3b8117b038839beefa0df5a7ce
SHA1 c8d1e8eb4c71d5aa02e36fe3b7365374a9e4e32b
SHA512 89fa9f31f62c6e119e6280dbc475c35dd7bb37c27457732a0b1cb04809a35fec44a12ccb6a3a626586d596a0636d754a9ff79ecd9ed739c5c6edea50738a60d7
TLSH
T16AF07EEEDEE8213EFFB2402980590381A479A0D281A0C079C4ECC8A131824F506D8AB2
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 a584379ebf9aa0d3c0239edb7e1f114f01a9865f01c68494d5f28d410ba8d873
MD5 2ca9f57d61ed45337ec4e6565480367f
SHA1 fa06ed14d72ad8ced6ad98a4e223bc80cccc5e75
SHA512 83a172f2f304b2f634c313e248b62c11b7798f416872929ef233134bfc4ad8f44b1b4dfa123e8378a233417e1298a73088258f5671ace96ff677d1f26447de87
TLSH
T138E0C0C06177584A5724A237D57811BC54A703AD708901F557CF87F439AC4D4E684973
MD5 SHA1 SHA512 TLSH

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 0e0084df79ab98e5df48ed1e01987f7ac3fcf4a038dd5453708d868f73a073a8
MD5 74af10749d7f19d15c8dca65a7453415
SHA1 dc96d9dbffe472600548dc64c724055e62620d8d
SHA512 83d190bf6f9cb77894e7aaf84029c40a2a0335e43d08062ca2275a2cb7a784a29b3b7b8be820c7dfb2f1458ab0528fcdfe45f05491be673b30495e1ed916999e
TLSH
T1EFF020DDD19B707ABFB20009C159427C9469A0DEB1609079C48DCB9131424F012D8A71
MD5 SHA1 SHA512 TLSH

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\icons.png
Size 7KB
SHA256 a870c4e9ff6c433b5583a8f09fcdfbe712241c7e7d64cd59a10c2ad592f64fe5
MD5 d3963e6fe853dbd9d22f794d5ece4c48
SHA1 db35a3e565d0b6dca7ad243443a5560a1247eb33
SHA512 fe60a1b2a20d3c11152df2d6fbee05c3d6b80c89486d258dd6d318c3f89deef3e91a116c502c117d79a5020489e394194310f5c7a7ea3d4b7d284ca5a3e43ca7
SSDEEP 192:ElLtuF9LXI/1SEyrQk2nAZho0MFL7eSAJ0bOk:ElBuFFi0QklZpa7vAJ0bH
TLSH
T174F17D5DD8D4891D6EED803FD1A250BCDF264D0B0241482B84B7F2258EB62BF2E15ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif
Size 7KB
SHA256 d6707a7a393687bccd92de05cecbd746be791f3a670cb4fc106252f49d2a0a2a
MD5 d4585d0ccf35ae69b1246339cfb46b90
SHA1 1fffc3492684a5db89e949d2d8b612eabb38994b
SHA512 a85560cabd3ce3dd21177948884a921385c0325b431dd281edda61d3585a69ceef28cb339c5a88d167597451ce22d54828b03d69823b5737bf3e253bd9bda9f6
SSDEEP 192:PhbJmPneo05p5xzt6/nuca8AQBE33rA8oIeUJjLd0VZyWtCmy:aPeoYhtynucBAnJPC3ty
TLSH
T182F1AD805C520AE7FF063D3E065B8C9DAAD0D6D2ECDE144329E893CB60AA2770004F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\icons_retina.png
Size 15KB
SHA256 8c659d0904687a97d9c6b649e4b74e99b286265e92252908824efcd07f956b66
MD5 7045217d47de04c1d72eea7413b780c4
SHA1 04c73e38fa17d35a1f684577cc79d77615c09e02
SHA512 abe433cb154598ad2c0de6070d6e75bb70274a58ce92007ce200201f788553517bb579b0df5cbde3b4f2bebdca1243f0e54836d125d72ea206b3ccba1d15a385
SSDEEP 384:DTPDm+LFPXcyFstgrNz9xhWeZ9I3D73sY8mgivkTTAi:dNsrgNz9LWUC3sYJg/T0i
TLSH
T19162AFC6605F5C5EDF69A838197E4602167D4C2657E8CDE20CB3381883BB9EC532B5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\new_icons.png
Size 8KB
SHA256 a311b5a78e1b856505337b90e53edb4ba380160234e1b4e8801c231ba8d590a5
MD5 0e366a48bdf6a3b140508e56eed0bf0f
SHA1 bcd76a4a537fc00d8c468b9496d3d5b5dd6a2a7e
SHA512 1830e3e260a50f79553673bec5775c0ba623284d233c25a2da016f273e67e218f5d2f49bed5f9e68842c7dc14b852e979fbfc7ed336f9a34dafd04a48742f827
SSDEEP 192:1fiztrHb667LkI4YQsZt+MtRwQO2VHjGK84JwWvD:1fi5rHbTnZ4ct+M7Vw4LvD
TLSH
T1D2028D186CFA81C2F02E227A0214D75CE402CC55269279E3F43AFA72AA7B0F941777CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png
Size 17KB
SHA256 f84c7c93947e86e2a499117d4c55910de9fbaefb6d703a8d0f90f4867c69c182
MD5 28a435033f504be69def6f9d52efd2b8
SHA1 6f50318e05b79851a445f98d4b3ae3d65feb22ad
SHA512 a2b410bb6bb328eb1e3af794259bacce7918f44698c8145fa530af9be6bfc22a064c1f0ee5d7ce289f4a60a50fce9b56a720793d19ec477340b1d7ef158df6b0
SSDEEP 384:ritTudjWCCmQw5bOualkmv6K4F7m2hDNWzpiyc7Z2dLva1:K2armQw5KlkZK4F7m2h0zbA2dLi1
TLSH
T10782CF51A0624870E81F6F384765FD43718CCFA81FA59ACD8852B37A8BBC1F219752B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\images\bg_pattern_RHP.png
Size 179B
SHA256 041917c06c638a1b1accaf0d2f0b2a6dd335dea629de602e104553024d822ea4
MD5 117ec36a5cc6d82e63e8b3beae4a3099
SHA1 4c692192be53827f8ec8015ceb129f6e0f89e923
SHA512 abb02a02a9161ece12464020676e880f1eed96b43a9dfd4f7ca06dc203fe633b0a712da5f151d36a5644d65aad7b2880c135df0bc42d7c1e61b44006807a8c9d
TLSH
T18CC080C6F7759C54FB7D03336BD70061D8C20259411117DDC184C12065D430CD4AC1D1
MD5 SHA1 SHA512 TLSH

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\images\illustrations_retina.png
Size 19KB
SHA256 8b32854c17056ea617a680cd26ea91015e77d68260f656758984583eb6895a87
MD5 ff84cb8f89545b86e32abd27a9694e1e
SHA1 3cde537531f8689772bc9eb39a12c687da5d5225
SHA512 2690d712ba02fbaa769689d0eae380d0988721c6fcb710e04e1e2aba56496cb58f5d4168fe75540139afce179b1250c2ceb11fc4c3d589a3615ad20dccacc8f1
SSDEEP 384:VQZMuIQKqkiGyYMZigO5RNclX0Gnw9Napau2JjhlBT2i4upBDWudqWh:VmdkiLeNcxy94ghjhlByiZv5dF
TLSH
T1EB92BFA727AD259EA88A3D0C11340143E4777B30672D3DCCCE579293EB9E4C2CBA7958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png
Size 703B
SHA256 a7cdf870b0b1b8459e94ed25a29daa87f5e9050294bf6cdff3bc72f93b928f94
MD5 ccc8d470e94b3441e41521572ba86ccd
SHA1 d294d7e78b596fefcc8084fab7917c54d3043e27
SHA512 f3b2ca4d3160a089f6959b7c8e3e6c213c0facb2733f7948a7222196d3bd8c7350015602569df2cdc7408e38b0ff6700306d7e3439f0892b4d13d9f2d5329e42
TLSH
T1D10194E2231ADB041BF25B36149688171C32C14730001F3EC39ED901EF845F945B1831
MD5 SHA1 SHA512 TLSH

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\images\themes\dark\illustrations.png
Size 8KB
SHA256 19f68990146444907956056019aaee514c522c3c00ae00604da44a1bec2f8f51
MD5 f6e318123e7ad5933a49669eb035c737
SHA1 ed8938fa3c13af75978bbd0bcdd3e8bd40a02004
SHA512 b2506a283dbdcf40ba0cac63b4fd0249463218cc9511ce52cae5ab8c36706090fc1f1942f1082204dcdad5d80e7b655d9e12326c820ac21f64a508999e130743
SSDEEP 192:MXIq4QWGpHcwscvAphGaB13wn49aolkLN5FJGBtxf7qTF/jt:M14spHcy+rg11alfO/Z
TLSH
T19C028ED7D6ACE872937F6733322B4712C049C456E06249E2C987E0D2AAF6C1B8C51653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\js\nls\ui-strings.js
Size 1KB
SHA256 d74c0782682efde01c1c30e46814256f7d16d7df00a7167d90f2bd55ebaab626
MD5 d59d8ff7aaa17ee875adbe48b7a77e78
SHA1 7405acc07f6137b7fd9575f99a2b4354135956ef
SHA512 63fc8bef9e8ef833e45d99f954a9eb99d6bbcae39b2eca8a7000ac11b976cdd0ce0581e5e5e6b2f1bb2bdc911e31690e503dad945f0a3ea702dfe404896eded8
TLSH
T1CF1110A0B7C82D5584633D775093DDC8EAF4992AE597A54C298CF01913CF42543FD256
MD5 SHA1 SHA512 TLSH

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\example_icons.png
Size 683B
SHA256 57804748e775c08ae188b4d860f31e4482ab99b44ed1d8489780daa6756fb11c
MD5 a0522ef468697e74b90c444ceb4aa17a
SHA1 31fa5bb9b4ada150c9001b6e9f3213644117187f
SHA512 bbb91f8b3c204c4c04da2ad635eb18e9f224f73395dac509c438c0a645316162b6ff78e03e7af76d5da2d9e84cd0c4b5e9db1d4dc08bc3f524bcc55c1f4dbbd3
TLSH
T1D1016202FBD68AA1A02AC4779291882DF0620FEF5E16410FB505785649F419CFF56B63
MD5 SHA1 SHA512 TLSH

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\example_icons2x.png
Size 1KB
SHA256 7a610114be56ff131462bc67f9a23bcd4fde4fdd0158691448ab9e4a3eb2ca3b
MD5 99a1fefa123aa745b30727cc5ad50126
SHA1 c48f74cee78f8ed8463634d80c4112f3e12bd566
SHA512 504800f03a4aa57c1cfa15b28542382728b5f3dd85309fe12ebfd711980d78d15d8241d5f54956ee41da2cd65203b7764ab7b15119457b74ebc07fcf8e55a742
TLSH
T18821A37036E45DBE1A76C43111D4202564DA4F33F8D52292EC317C125734E10F399927
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\ui-strings.js
Size 1KB
SHA256 196c132938d324c62184ddc85bdb1cd642af830712e0fbf0fb3230978316d510
MD5 3dde11f8594519f004ded2687db9b90e
SHA1 fcf1854df851616a25d7cf1439a9120b16902420
SHA512 adc2cb3a37dbf5fe2ae79f5752c0d38d2427a95e333e848ffa113046f630eaa967b3cb29c049dcdd9b921d57e23392562d779c24207f770aba6e92392064f17b
TLSH
T114210290B7CC2DA588273DBB5493ECC9E5F49929E49AB508698DF01D16CF82543F8246
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\task-handler\js\nls\fi-fi\ui-strings.js
Size 823B
SHA256 b333de3a4a7be7749b82302085ed26ad868f0f8eccd09d2a8bb8840414e624d6
MD5 5e884e2f05ac036b7a6cded3efc2ea2d
SHA1 807c1cf1bf0943404601b6241bf4bcf9fcc29c9e
SHA512 6665aa6fa35e05d01a4a2312a93faf52d6b39409bfaa861c187b0cc2fc51e74aa253ebf56061872d548cb6d3d7bbf1f7c2568de81e5287e0a1d6591c1e780f15
TLSH
T16A01FEA4BB151C56C06631BB60EB8DCCBE38A91AE1A3A49C588DB10913DD935833C31E
MD5 SHA1 SHA512 TLSH

Submit Download

home-selector.css

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css
Size 802B
SHA256 af439ebb0d55750003f7dbec517e7b0b26a6a0506b21e3b74d800cd1c7faa004
MD5 bfeb063e064c71e44ce75898e79c61bc
SHA1 c4dcb4b6814cbee53b415a2a5df02fa500510ef3
SHA512 0835ebe63867fba6d69a25c83dca767ffd9c57907ba76d9c71012be18510e2145a358d37c1cf4e4ad35d1cdd4f67ffd5928e70e18a376db607d8482356f12219
TLSH
T1F70123B473116D1AC03531B760A7C9CCAA397809E1A3A55C0C8DF11C17ED936833832F
MD5 SHA1 SHA512 TLSH

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png
Size 2KB
SHA256 e34bcd5b8436d3bc45f98dd913d41f185c6b06326b66937d6e0d5c6434b16fe7
MD5 4c27ad089d04cfefd979d56f2a67b172
SHA1 63289f9198ee4553759b07de7a4229ad370fa976
SHA512 23f9283f769fd310dcac26cac00d2eb033763d73bd45b0d148ea1ec3a3c75b073572c9fa9234699372a7e1caad7fcde7629d004815536df1d39d291f2d2d96a9
TLSH
T1BC51095B6C990196868E3FB405C81486D463459B0E45A1C5F9DCAEF33F145A320AF0EA
MD5 SHA1 SHA512 TLSH

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png
Size 2KB
SHA256 237a70fe0388ce6884f5424692c460625691ef7acb0bf80403ec6b25f348b94a
MD5 61bd39ed095fa82ffd334fbd7982616c
SHA1 51af9c2cd42743c5cf81200e0fba3cfaff801885
SHA512 54dd8e1a5c19a9d51892a12e9501b7f6f69e09e0c446ec36f7ddfd9ad0d9cef52604ab2f8071c71ce63989510a703f1cfd5492e1ac20c8b37258ba21f8952400
TLSH
T187513DF1338FDF6DF0999E635EB61DB06C5386470341019EF09D587721CE229915281F
MD5 SHA1 SHA512 TLSH

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png
Size 4KB
SHA256 03bcfd7fcbd98e48b1954f912ecd66ce0bd5c181da0c2408beed01486ed23804
MD5 543415ad8ba14db1b75a93a551a4abfc
SHA1 3d4737451e899240fe19daa07f3c58ce9a623631
SHA512 7c4bd1cf6fc8d7aeedb1c666ca45c95615927fe76cad3d3c4f4dafc987f4ac04f527ecaebb3103f593eb080302e768fcd77739ce8344ff2e7ec10efdd1113cd0
SSDEEP 96:PLzHZxtvMK4G74Hym5L0kM8360mEPrXFeQ1lPdZFEZG:PLzHZ/MK4GUHyaPVpFZCZG
TLSH
T184A17D9524F4DC8DE934CB295237B7047FB2A3442EC016398B5FB12CCCDAA248D655A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png
Size 385B
SHA256 223f32512aec50c1c00fafc476d8e4ce61e79aa748c67b72fe55514882a31a5a
MD5 c789d387908d7b7f21c6474a86e84019
SHA1 1c36fc6954178c43d9249a5ff3c7246057c6aead
SHA512 1cab85dff119b591046049b69b6208283ca5e009d95129bb407df2768c82da30fd2af8debf6f1bbd91f37518538f3ba6bcda32b63d1d278b56fdd1f5f93439ca
TLSH
T16FE0C0C3B359BAC4C9860E32E193140041655177A9E307781088E9F52CEE90178903F2
MD5 SHA1 SHA512 TLSH

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png
Size 1003B
SHA256 2e187b74e926afe70eafe0648c7125817e99f5586eee3e2e05446e360d4cc1bd
MD5 c5aab3d175e0a3753ed2c3bbd7b929c1
SHA1 3ebee0101ad62449a67f506df9c8e7dacc39f877
SHA512 e967020462477c3e9465e3383c544cf468dd89f4da084193634f5bcdc001b90f5bad3f4f6dda9e95ebe068108986daf41504e02331f4922ea25e7ffee1f27040
TLSH
T13411A5C8B6A517184DCE2539B906B87294B3CDA44CAA77CD684FA07091B895BC1E9882
MD5 SHA1 SHA512 TLSH

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png
Size 1KB
SHA256 c25d9409ddf9645c2731ec785cacbb7568005bfc78fe0aec7df3ae3c4d30e333
MD5 808971f45b803583d9d1f812803d81b7
SHA1 0f6aaecba7c976ed8c2f53782b3d3148f41b2905
SHA512 121e6b01125f9e9d4894f7d498bb4d39ce676ce51e29cbcd148e0c1feed46fbc58267cea7d5f66654be831dc479e4643be8b28b005467309b7df5cc7fbcd0dbe
TLSH
T1B12150F6E206C8DCC5E22B71C2BF143571A39D88A9E9DE05FA4F35324568A7848F15D2
MD5 SHA1 SHA512 TLSH

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png
Size 2KB
SHA256 537ac64cd204d7ef82cfe41c932deb9cb1ae738b2156eff4dbf73208384c0a13
MD5 ad68c0b141ea1dbfcadb540c1817289f
SHA1 548a46167f7f5193c5a1335753bc208bf92aa504
SHA512 269ae39458a9f30351166f304825b777f3ff143b7914b98e83e01600fa04c7790e6e813466c2a1c5396ce13cd2199792905cf0baba1cd28a420440efce0843e8
TLSH
T1DD510A0B43A398CDE9C8B0F8875C341B18D3E46365C0EEEACC2659F414AE4ACEC701D5
MD5 SHA1 SHA512 TLSH

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png
Size 289B
SHA256 d188ab283c552eee50677129f3b0ffd8d97828c4e7007bea258174c9a2200e87
MD5 36503740756a442b7be294947462be83
SHA1 a1203ae869deb46f59a3273f6d130e7457bf5321
SHA512 6ff98b15c7d757dd351bf50a1c4ac759a73fdafe03d5fad506478550987d0ec016ba9e617c099e6bf7b0263846eddc4eb32cb70fb1fbbc1189791defe556967a
TLSH
T1A5D02BF7324CCEFC995661B2073A0049E61A52B62345192884C9D3B639C4C891429F67
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js
Size 840B
SHA256 434731fdc6d2f5115c5f7786ac989fedef7d0f60cd2ad4385cc98f6d2160566c
MD5 32147da1c647161e45a1004eb1b16349
SHA1 a953c222cce91729ebab36bddd43bd5a795a69cc
SHA512 8c825f8d38519cdac2a49e4ee8a9564ae72839199562ce9acfe72b4fbb94f8946775054782cf26a9566eaf8cf944a26e42b7b372c4e7349b33a8e17dcd13df94
TLSH
T1FE0144A0BB151C15C06631BB50E78DCC7D38A927E1A3E48C4C8DB10513CD831433C31E
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 0938b8f077f7ff61102f958f4a39ce6063c3250f13be1c688cce377f63272ce0
MD5 5af33f816b01dbce307811737ff6debf
SHA1 3039d6ffb73c2cf4a241b25c03a56fe905426653
SHA512 6d5052a1d358ed6cea561193d0f9527d1cc09977ea6233e85c926bc8560c28b56b3fda350a12d9269489691a7988df005b1d6efec7e2abf99c6e8a95b3e1827c
SSDEEP 384:yesdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:P+eUZsLQCZsL3hUS4
TLSH
T10353CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 8a6d5ab9ccfd33687dd882841d422947640f403a08aa0db58bb40ba851956f94
MD5 6a7b6ac8f7cfd6ea35f82e8b7c414dbd
SHA1 7bde88c06650f143861bad03f7b3492c9543400d
SHA512 511484b2eef80e58668620122c6c6912500a1abe5c7962c7d8fd70433f31f8f062d0236fffcc29b44cad5f5b01e012d04e5f2972976fbd2ad13a87d1f8d2fa3a
TLSH
T15611E182782BA0B029413175E9DB82F63BF1977D08A52275B1C059CEB871F3A06A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 175001069c9aa844aa1dccfeba6669d0fefb6fdbba03d9390e678dba3ed674d3
MD5 1639e1feb98c34021c987e114ccd70c9
SHA1 512df61bb9de065368f1946c579ca4946210a05a
SHA512 d21cc2d3143f342423069a5a06d01b5f23574ea8639033d557a9ef481f537554bb2887552d31be9d11db286864aca297b0d931c63e10d0a60f1aae292cd7a502
TLSH
T15A11E182782BA07029413576E9DB82F63BF1973D08A52275B1C058CEB861F361AA3C24
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 7e336395d6fe86b7e9174c06a02a8d9e30bcffbe921c94c2c6c63979b237e0d2
MD5 8e3a966c76cb91622161a4811fc0c6b9
SHA1 2ad960e43bf1a31ff72a498f7b3470fbe500ede4
SHA512 a9d073a8becf6592000d94974877bd0104dcda534788e0289b2e8046f078008a8734e2263868c49d31bbd4dedf1d51d3360cbe873a33e34dc8bd1d86827051f1
TLSH
T16111A582781BA17069413176E9DF42F63BF1A77D08A52275B1C458CEB861F3716A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 e94ed703c880dc054137c8de6a731bc8a9f06302b59f2ebe4de3436e582ad464
MD5 0e287ef1530ad82a789e6f511fe69b9d
SHA1 1ba51bf0716dd402f6536f11d49008a8fadb7ad3
SHA512 9fb21d01922c214254f52eb933efa6589f9d2a54772ec777b0eed84f968edcfdf1025c81e64a542f6390dc11554f568bf0f156b1e54b8d57dc33d20a51c80d5d
SSDEEP 384:EoZ7VvSQIFCrCwZ6io/GUTySCkervC2NJM5bBsUq:zTaQmaCviFUThervC2bMd2B
TLSH
T16542C07A1A75ED07CD377A336610F90B9A6DD28A1748520753CA0B798ED1BE003919CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32a05c74-81ff-4170-9b1c-6ff52c7d00ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32a05c74-81ff-4170-9b1c-6ff52c7d00ba.tmp
Size 10KB
SHA256 c70fbd66e3415be9a18989908c95fbb0c070592cae4e2dcbbc5a91dada0650c3
MD5 1942f4e7c1cf676bd3c3627decf33c47
SHA1 b481e3deb736be2beeeaf1bf05e2eaa39c8d5bde
SHA512 77a5abcbba3be877d4d9f978cead5482e4da3274d60f95c23d4a3320af6858077e6dda5989772f08e8412ed8ba168970b0e962399bf2a2ce5e5120a6d8dbcd0a
SSDEEP 192:JR+V36wv7EIAPRp2V97Hsb+WNn/rdReSeYw2TRVyIsnAUgR:JR+Vqs+XyVwTdRlw2TR
TLSH
T13A32932AAE10757F9CDBD21AFA757BA3D6F5002131952E84E6FC893C11E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a359386876c6be84119b258011ea2e28785eccd65296413ec038890bc5232148
MD5 5b8fdd566858516896325e94fe08e080
SHA1 d6e1b5fbfc6d9cf432a23b5ba4ab8896c55111ae
SHA512 17c939a926b8448e32fa4d4ab68e0c028759e75c58720fd92d62cde600a7a40d954133d0cc41df36a3d3a2a787108fe4a0b91f82dd787e5664f700c10684cea3
TLSH
T147518AB3C3D4CA7D881166E49A216E2FCD2E0E19522D3C56D8D8EE4B53E28B2D31134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bc56250931efac8778253b891b4b5aa8a883234b550256d0c4d9a3dc8de857d7
MD5 bed09ad9b7964cd28262832d1b48bf53
SHA1 e326622549013796e672e5836b828776b2d93bbd
SHA512 c0a6e6a441c0656afd72b57d6c45a6933221aa6238297fb2b21efa8bb906a6dbd37bc19ea3ca6e722174a2d486860de20222b8fa921a3a7a23d2f3bda1544b39
SSDEEP 192:JR+V36wv7EITPRpdV97Hsb+WNn/rdNeSeYw2T+VyIsnAUgR:JR+VqsnX/VwTdNlw2SR
TLSH
T12D32942AAA10757F9CDBD219FA757BA3E2F4103131952E84E6FC893C11E7ACD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 ca4b03dc57843d11497011e5af8dcccc201c5fc26f18063dbf416aabdcbb8158
MD5 83056951a03807376e3b0533b5dcc6de
SHA1 14f135f4768f1000890387b9e10041c37cb0d66e
SHA512 0dc36e0e6d60bfe286dfec5c9ab150291c2edcc796d65a9cfd1ae3df3c725c63bd7256b1f8362e511c9b068d4b659fe96bd70358861b3886d6a9cd3d3d10148e
SSDEEP 192:eqB4K6uU7KxkXqK4I40pUZNCgVLHrKHfFKslEEEmXzKD/lc+ErUkKN9na+LIsG/I:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmk
TLSH
T18032EA17998D6A7F4FD8E51DCC536F8B6DF4019672680C2492FB9C0803A978A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3bd0075445a3813498959cae370b28f53184313eabd8f5070147cc923ced25de
MD5 f47c434c949dd65ef7f0ffc797d2d315
SHA1 6ec0f8f1b6ec8e3e35bcdec4eb154a7731ee8128
SHA512 a6e886dfaf9ebe18bea5743b6332e43de3a2d10b23c42c9379b186a70afc5877462770a0a2b89b095d79fe40c106ad9d80b66a3ef6c036e33741401c6540ee7a
SSDEEP 96:eIVC6Fd+pK242KafJf1Oc52ESl8h4otop56zDbB64Gyv+msQxwzmRFAXBQH30j9n:ZVCCbt8OfIiU2Glc0HxbRKXBQH3UJZ
TLSH
T10BC11870B8BCA8B369F7D564B5033E87CEF4629726519F98EDDA4E1C10D70F81382A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 96f26fce36382869c92487d6b9fc34315335b6d4ff70f54043c312adcf9425b9
MD5 548c44110a948cd4a63a1ee9894dc437
SHA1 1dd3b9e975e7ee6c00d56c995513fdc77031b6dd
SHA512 f87dd3337215a6cfc490cd07c2ece6e19ba7ce83f04a0acd6b12a92bd4d06cd6758bc60d70874bb63ec9060d8069c4f864392312249981cb9b735ff81a503699
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok56sDbB6qpGyv+7hhH0bZv4a:ZlC0bt8OI8lDUDDlPUhhhH0bV
TLSH
T14CA11970E96C99B728BAC580B6422F47DFF862676162DFC4DCDD1A1C20E71F81382A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 59be9123ec53ced63ced6d68c05fe39c139ce49fbde5fc50a984ff9d3e6966b9
MD5 1c7ca5ce425fdbec723417f614f7034b
SHA1 5e7c536558c479eb52082d51d52f39a121421f66
SHA512 d45b90824abed61d546afb35d99af7e170567da35783ef4803191708b50bdc959daf3fc68fc22b2221a12b8fc92f6a1fc1681bc9b9197b6ade2422f2b0655d6a
SSDEEP 96:eIVbJ6Fd+pK242KafJf1Oc52ESl8h4otop56zDbB64Gyv+msQxwzmRFWX2QH30jp:ZVtCbt8OfIiU2Glc0HxbRkX2QH3UJZ
TLSH
T1ABC10770B8B898B259F79554B5023E87CEF0629766519F98EDDA4F1C10DB1F81382A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 aac742274b962531fd446db70af611b8b2b60377f028149f02bec490181b674e
MD5 3606abe27f97b4f69c4fd7394cc75aa9
SHA1 9a71c54eeb498b30c9765472194aa2818b3557f0
SHA512 2e690c592c923af8c891e041f4ba9b29ad38073567a1c747ef716207e64901f2cc5c2174bae928c11fb6dc551b3d317353706bb4116e454ef6015f05e86cc491
SSDEEP 3072:v1RBy6AztpvzHUpwjaRPIGzZvF3d5ZDTW:z+Dvz0p3IGzzZDTW
TLSH
T16DD3122D38D65D735099D070F83FB47E992CC24F43B6EF4598926B19C7AA88B034BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 acc042c89e073b1d882a41e77ae3ccdb35d7557d9df2d23b5ae469a7158068c7
MD5 b0c5dd7aa58e89397fcd554dc91e78b1
SHA1 5121865ec3183d347ba2e6fa4f6d73f4258fc72d
SHA512 33dda61fa272230106a702f0ca3603409db4af247585fd7d6e39fe1e4dd400eeebff185d6530bd0fe1b09b63498f238337b02c96fbe819bf0098ef26edf5517e
SSDEEP 96:34s3HDps59vnjn4EVwjKvfv764LyIQgirM59LJ+i7AFssL/swzZTz7XzHRIJaU0n:3HKnvUUqYSgfSNL5friJOBpXBx
TLSH
T19BA1EA49C5F4226FFB2431B459AE5F5761A8958CAAF75F03330E80FA3EC32D1824498A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 05ef1134f732767fd83d4977469d40857b1ca09d4f7239ba793da7849882a0bc
MD5 b8676916574e7069f52f3a180151b050
SHA1 6f3eae8dd571cf2983c51cebe8f426a69fadc482
SHA512 da9abc772766791c54eaf2de9b61a9ace31284a72fbdde7cb948d6b53adfa29efe141e14ccf2e77f3bb34a3ae6278f7e5817a1aae1761dd28ed51cb6b2d07d0f
SSDEEP 96:o4PHDpsQ9vnjn4EbjK4v764yyIQgirM59LJOi7AFssL/swzwz7XzHRIJaU0ekbpt:oIK4vUqNBgfGNLGriJOBpXBD
TLSH
T1E3A1C849C5F4226FFB2431B554AE5F57A2A8568CA6FB5F43331EC0E93EC32D14240A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59debe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59debe.TMP
Size 3KB
SHA256 1cc958bcec045e6f4805c1330a28dfa685d1a1e02da962e2846522b9b48441d0
MD5 7d45188bb6ccd43105c5a2fa7ec594eb
SHA1 50f3931436f6ddefeabd55df27f0d783710473c8
SHA512 f7651b2e1f2b3a8f7c700b73d2c7bd68badc1a641720ade3f29d35a3b7e6f393f971b4478888ce2e67ed6b398a7e15e2b1b0710e3cd8295e8b78f2a5ce3b0710
TLSH
T12371DD81C6A956B6E35530BAA9DF8987323D498CFEF3AE51731FC0F409C379581844AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c5256df85264469b01b57ef28abe34d380fb07f2f5a8b8afb1ad7a0d7ab948c8
MD5 7d846747736d5a38e1fa3ac4ed544910
SHA1 636bdc101ca1f58abf58d02a62f326b242de5f64
SHA512 a5a6366a7914f14f8e42daeb66e4e0da4aa652ac9a6ef15ff994917ed0190c510ffc2a841d0a82ed0f30c5471b6cf4fa5e64a14efc70686f1cafad0de519e082
SSDEEP 96:DXObX5zfxUjhnbVYfzBrGO5zL/H+tjtw1gx:D+bX5zfxUjhnbVYf1r75zL/etjtQgx
TLSH
T1A2A1ACF7C3E9866DC90196F0AA146F1BCF2D0555436C3C4A89D4AF1BA3F28B1E151A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fbf5a18a97d5dd11475d233bd665a95901a3705b210d8466ec36165c82e2b9f2
MD5 b2176e73fd62e09db18642818ec35046
SHA1 fc83f3d0c0822411fc932fd1f9a4f5d9eafe59f4
SHA512 75fee6aeb34baceb3dcf36f07d3290c795151ad51bba673c162440dbf97d65156345263e15baf579f1007cfde6acf9d4bffb3e1c2e57c26676599484e271ffa8
SSDEEP 192:sxRnRRxd/fGsKqmBJbOtoA8pJ5/g6+WNPVr/Yd3HGshIgDD8J:sxRnJd/fGsKHBAkP/5h/oY
TLSH
T19152C706AD68A93F9CC7D25DFA557B53E2F81032B0D45E88E6FC8A5C04E66DE121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2398a89ffdd12af606d6e3e7dbca44e03f4f474115473ef7e2f24bcc86cbea39
MD5 5a4c319c8aa01ca845c8754cb5ffd919
SHA1 1aa59be533060afda3dc9e32b1f0a3bd64a00011
SHA512 173ce37794556be510946fe040fe1eeafc8ee33372e95f681376901c344c1b1ddb44a357ac791e357b3629beae6325d69d0ec0bd15bdac87fbb04160d61bb67f
SSDEEP 192:sxRMRRxd/fGsMqmBJbOtoA8pJ5/g6+WNPVr/Yd3HGshIgV8J:sxRMJd/fGsMHBAkP/5h/oq
TLSH
T16552C706AD68A93F9CC7D25DFA557F53E2F81032B0D45E88E6FC8A5C04E66DD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 426e01b208a0ed71c9b755966b5e1d4f401e1bea9d05bed38d0bc5079b1b7dc5
MD5 242fe45e2cdafb7f767f69eb572145bd
SHA1 3bd73b99bdab0630d1cc228bb7408e0a18ab0b20
SHA512 93245a3e81f73826ab24fe3fad8e8691afc98469c71ac628cef4940c6b62630dbea50024064859921cad2177a6814c92aea66cde5a6dbae4c208c5e3acefdb50
SSDEEP 192:sxRnRRCd/fGsqFqmBQbOtoA8pXtv/g6+WNPVr7ke9fPFcdrHGshIgDD8J:sxRnad/fGsiHBvkN/5hPfCY
TLSH
T14852B716B968A97F9CC7D219FA55BB52E2F81032B0D45E88E7FC8A1C04E76DD1217C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2485cefb2211851166d0a166477b190611aa3542cef90f810a69f479d7d7d37c
MD5 652e2585d0640bbf70908d509670461f
SHA1 7516b131252feca25ca2438b8be88a150661568d
SHA512 9c6d2844b3986391a6ea0a5130f437be56dfede08cbdbce706c8efddf1ec0dc6f686e87dbc7113ebef1db16c962b0878bb1c849fc563f1763921931bc5657161
SSDEEP 192:sxRnRRxd/fGsLqmBJbOtoA8pJ5/g6+WNPVr/Yd6HGshIgDD8J:sxRnJd/fGsLHBAkP/5h/7Y
TLSH
T17C52D705A968A93F9CCBD25DFA557B53E2F81032B0D41E88E6FC8A1C04E66DE1217C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 777b3c24f742a2ddf4083631bc03bc0d7c476071f561655dc75fce346e388093
MD5 974d084548eece57233f1bc86e424c26
SHA1 94868c166b334d0c6a84057f771b00ebc6280830
SHA512 922f08977a320f1c87e8a694f01b7e9eb1e172512487ef358877651d25d002815ca115119dddfe432b13eed477cce1b1b077546674569657aef70b1a078a4052
SSDEEP 768:qF+zWU7pLuLb9oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7IGUjrobW:qF+zWYEb9oWgU6f8Su1jagxUQa
TLSH
T1B6C2DA7B740CCB7F4F900ADDD8197E9B6DA802CB9698CD8047FE945C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3f2b7e4-36f8-4f1e-b3e8-740413f20b40\index-dir\the-real-index
Size 72B
SHA256 c157f284613ed9755f36c342d18df2212a8deb6ec1490e8033fb1bf415b075ad
MD5 cbd84745577e8d542538c85da12605a4
SHA1 96e548393053d1196ac94599bb3265daa50ff065
SHA512 2708cc333e7490f68df9e77ced2b0d65c5bba99886949af2f7bf03a426360a8998595cd02371f4707342bf11c8a1458b6164013eeee46c1a1e89188c5f8f7a7f
TLSH
T182A002124B830006E65361B25E5223611711C8152540530B42A30054CCB65584D4110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3f2b7e4-36f8-4f1e-b3e8-740413f20b40\index-dir\the-real-index
Size 72B
SHA256 24cc6cdd4c7ed598f76d585d7fad1e9234702fa72a893234d78048179d484d5a
MD5 4a6a4353b3a05913ad0664b8ff8c6ab6
SHA1 164fb5261ad32fac4e124e6b71560fdd4156ea8a
SHA512 70d8f1c8b5548fcb61b940f6c6e86c65875eadd07e0ffbd1fd4bcc527d84dd2fc0127f55e487c361ce453e5023cf46d710e9876a8d9a8f1742d0ced5beb1a179
TLSH
T1F5A0022CC3882415C14713F06D96114A6B34CD514603130771900245DD9554B5EC140E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5c12854-6461-4b87-8aa7-b2954fe0181a\index-dir\the-real-index
Size 696B
SHA256 4064e108de574674fd15247b0e83f1546f062cf2e5484410452a98ef45012f0e
MD5 8ee347855916e28c89bdf4e009e4935a
SHA1 6938d075b3498e732e008cef61e8daf968e8976d
SHA512 6588cf54227423cfd366e77f884c09a55d2529a10b9cab2721ed17feb8575997dd3309f638ae975ba0612c057a0e02320a5132cc18f61258f2fb373f3a697cce
TLSH
T1170105496D129606FC1100701975685DA67110ECC344768FE0BED635CCE27C4DD03964
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5c12854-6461-4b87-8aa7-b2954fe0181a\index-dir\the-real-index
Size 2KB
SHA256 d5abd497d8be5e02bfce47f135e1ac2203da6ceacf21f86bff084512faab76a2
MD5 948e1d45cd09f171f667ed52b646bd86
SHA1 7730f2583fd0f7ee3b9359c1ac5870e69aba2e7b
SHA512 c61a98c9cad332907ba04f49280c0f638b6060d59eb2b9bfc56b58e2cee44b5e5e4e3634ab70a1be78f70d89ee052f5b44f6dfab3a3db770379d0c1e7d5f68ba
TLSH
T1C141E703AE529F6BEC94C9B406B4151E337432EC47496B0BD07DF039ECC3369594A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5c12854-6461-4b87-8aa7-b2954fe0181a\index-dir\the-real-index
Size 2KB
SHA256 80ced7b8d570bb8bfb22f4945e9b70f3e9fc0b194b0cd9c3358303f837376a70
MD5 c05c691691fc43cdfada714b0715758f
SHA1 b9eb23451842c94f9b59d9156ecfffd590ab675e
SHA512 5d635336eef8ac157a7b554559d6c021833d1dac41b4f193b57b87cba19c387edaf2da767aaf4461392eeb7afb34a59aea9ae004db5219e2656679254957e182
TLSH
T15E41A6036D519F6BEC9889B40AB4041E337431EC47496B0BD07DF039EC87365594A95C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5985e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5c12854-6461-4b87-8aa7-b2954fe0181a\index-dir\the-real-index~RFe5985e0.TMP
Size 696B
SHA256 852ff52942f916122c1e7cbf0316f55842e211df35a72eaf065ba91746faf176
MD5 347ffac394f8e19a548e21afc63db572
SHA1 5a95809a51721ddde3bdd09b7cadc5dc04f2fe99
SHA512 609824530f39788e12971516de671f3acc5d7afdd80a5042906685ee8806c3dc79916858f059a9583e790d4a964bbaf8151ecca8a912c4d5539758c7965128e8
TLSH
T1A5010E885622D616FC0421B11EB86859B2B110088348738FE2A38128DCF27C4DA03B75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b0066a1010bfb56a76f3d544f0dad3e5f61f0401b31dab014207bd52dcbe9775
MD5 4030e36eb7489ac4175f743a333d3964
SHA1 36fe909bae3a085c103174be3f829c3e9996bac9
SHA512 06836aaf45b1758435bfd11fd01c7f6d787b89e0d8ec266ca1ac9726d5b10a86a612b784b9d4d4dae772f91aedf68cd49e15057c5b8384f65b3bf3b748994080
TLSH
T134E0C07F2EF72410EDBF8BEE6471409040403864C904ED5F4029B3E360B2300389AC71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0107dbffafc18c2fc11a1100af1a607af57d7eacf0efbb610fb30838ea45cc1e
MD5 f15e2938a41a236036db4b25fc1af39b
SHA1 a61b350547eeae942424c554a4b15dd9ccf1172f
SHA512 fb4783c80ecc1c33e8b53d8f7acc1f48fa8fd57b27f18158addc3ad56e5e1650b11ca2b3c5d9857306038d6fb5df973a50387824a6d2a759f871634d5a6bd697
TLSH
T18CE0687B2EA72410EDAB8BEA54714090404038648904ED6F0129B3E360B2300389AC71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6c36071e72f0f0d09538c0dac3d595a5a0f34291aa94d1c0f865fae03fb64a9b
MD5 4c61e41d3308a5b11297bb6cd40f989f
SHA1 50dcdb9f72359d5dbeb9eaf5ee5b6cb8f63ea27f
SHA512 904ea354dedf86255d29818b8952374e4f71091f316f0b7d5eca340e7f7729819ca2c9c1e2062145dd97a8ef734a72e91a7e66aadec1792d99a33582e617889a
TLSH
T180A00211C954C449CD2406789066069462148898062662B982ECB1559A631B0829A965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d9fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d9fb.TMP
Size 48B
SHA256 c6652e66f01fb19d5b34e5810b8a7727793d8cc1bee5c371812ad4650d7e4785
MD5 48353c141ee89e36c45ad18d59df48de
SHA1 049ab75df505e30ddd4fbc31cde6f884320d2895
SHA512 105af2f3d4f43202c192ce36452cd5bfcf8e79ed9fc24a46107163907f1d05e98b0cc218dbfb3e0bf395a51b0fba83502013cda67284042343abe42d0de19c11
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 1502360835477937792708f2c5016d75ead49011d1e47a4f0f7672a9b4b1cd7f
MD5 f0bed918287f20598bdb6d9a557e8d8f
SHA1 61276f097322a20903f0e0bd3367f34291a25fb2
SHA512 47d49188eb098d0fcfc1d0e5917438be3fe0988bebac394e2f7a5c1344fdd1c33b10b9e807d5dae960f9f528427f820d8d841b36f8224fa8c9e69a5466407990
TLSH
T193812524327A43803C7D641D86A89B6E534235A3351DFB7B3BB840A69E67E045DFE8C9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6802.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6802.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6a55b83f64afe8c23b9645371ddb4b1ac2ae9c62089f28b1108ccaeedcdb59a1
MD5 c3b71e61adbfdfb16c718b185de055c8
SHA1 3918204d1ed45aaa45ff39467ccb2f4cb990a6e9
SHA512 7898f2ad90ed5ea023f7ed0df2f08ae1a8dd5f41f0976afba844e650f10ce0eba4524934aa22d85ded6feb7559c79e38940dc5658a4a48cc0752ea4a36cc160a
SSDEEP 768:B/UxvxjgC+CZ3sTK3OkT1h3Yogkl5akl8pbHW0AWTMSHvP0Vv:UZj3+I3H1h3Yog05akl4bHW0AtSCv
TLSH
T1A703CF39EC659E778DE6E244760AA317FFF894636AC45A9444DCAF0D02973BD030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 40f0c84eb197d913d92298a2ba8310898ca9de3a3ed19b86cbefbe198ba2c839
MD5 28963413db8145a2c341d6b9ce554df4
SHA1 808ddff0f81277aa140fca7a23b451933df8987c
SHA512 3ab525291f401f739df1c35999f1e3dbfc70fd36610ffe6d566d2d46e086700bcaf51e1cea7321415af89bac7274ed2df9b6932c26b6facdb1e3401c5caa8cef
SSDEEP 768:0/UxvxjgC+K3zVIK3OkWUX1h3Yogkl5akl8pbHW0AWDwo8Y:hZj3+K371h3Yog05akl4bHW0Axo8Y
TLSH
T11103BE35E8B9AE7389E6E244B21A2357FFF8547369C44A9888DC9F0D01873AD070BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cb477d56464c77a0443663987fd635bdea07be7700ef8e0c2a9bbc3e0ace0a89
MD5 bb294d03b2f97d27a18035304ef589ed
SHA1 1e36a9a35531bacb18ed0a0c401da9d95d6fda4e
SHA512 7a891c3430863784d2ddbf0ea27e6fca401b757616a593de22071154bddcf4485b22171f13ed564f0e186e1b60d4cbc6819242b70c5b5e7aced330210acb9a15
SSDEEP 768:+/UxvxjgC+K3KVIK3OkWUu1h3Yogkl5akl8pbHW0AWDwo8Y:zZj3+K3j1h3Yog05akl4bHW0Axo8Y
TLSH
T12A03BE35A8B9AE7389E6E244B21A2357FFF8547369C44E9888DC9F0D05873AD070BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 f87ac03555d2d1fbed5f653f6c04d9c1cd82a0701263db19ff3b617192d38db4
MD5 9eda298ff3c123ad3b441bc0922e7e60
SHA1 0f20bc67ac852003b1d5254a920773bead3635b5
SHA512 5f2e5e6f100e4177aab446663f0ea20963d073e62e281681b1bd5fa441088dad86ac84a0e28b6234dcf81094af2d1cf5cb64b2dab8970834b6c80f8b8a535ada
SSDEEP 768:5Fg/UxvxjgC+T3kwgEVle3OkWUu1h3Yogkl5akl8pbHW0AWDwo8Y:VZj3+T3D1h3Yog05akl4bHW0Axo8Y
TLSH
T125139D36E8A5DE7BADE69785B3097257EEF450B349C889D8C9DC9E0D00872ED070BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19cc1cd4-dd3a-4bb0-bb82-c727cdbf47fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\19cc1cd4-dd3a-4bb0-bb82-c727cdbf47fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 35a45f0357a20fcfb7c5f10906b3736517f924152707ea3c46807dd41f53ef0e
MD5 9fe1186c0dabfc4fed211d2dd77ad051
SHA1 029f00c75500c83fa135bd5b44ea6a7f10b9b6ce
SHA512 adf6171ce902c8eecef172f034f2ff016f6a041d95c7731015a5a8d122e88c8e0f7d2b9cd57176e01d5a1db433cf715e5d6c2c6aff59fc2071c20e1e70261504
SSDEEP 768:U0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:6ZP2tFPuNnY4UmqEMioTaBacg
TLSH
T13C154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Size 1.6MB
SHA256 d5da9bbe0b9503765dc7af791330619d5a70fc17215c4a8a31314b22bb3b118e
MD5 cb06167b7505a8149f2e074a8f5296fd
SHA1 73266f896e8a6ba56695fc6142e4363849eae344
SHA512 861036e8d140a417dfd852dfcc3f417789e25038060b3366acc9d14c5a0ad11c66704b5f94d3e348804465db7601678e30c5987421c13e9fd5eb36be2ab1ba3b
SSDEEP 6144:xAqfYrFSZjTFODups4BTCHvrPoc6fm50eki2bkILZLlSq1E38OB5:pBTevLoc6fm50eki2bkILZLlSq1E38O7
TLSH
T156751F84E0D365136B79E61193A29EEEEFA541A39AC47180305D27BB9F37CC50D0BA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 bd9bc1fa7cb5297cb07e71beca5856d7cd086b9818d46a9fbb9a9791aa5aaf4b
MD5 f76124c702fdd71038b0e4791932471a
SHA1 3f8554a6067cf376585450abe3ca425d802fe198
SHA512 8ee3dc91c52af08b3b1f3fbdf9528909c611800bf1f6e3325995ac8a2bce08d0e1d511ff15e10eb98325cf57cd888d5526e130fbca32e310440489c8e1381417
SSDEEP 384:HalwSiO024YeWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAF8+VS+T:6l8ZYeWTToXJWTTogB7S/AmVAf+hRMCH
TLSH
T1A4727E7D8F013CAC165790E8C8B943598D1CB7A7DFF5C06D229C3E09CA88A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 ec8f6d0d0d22a308948aad798fb7f61ac7856d2d290de625b19e7abcc0373ef6
MD5 6a9268a53064f992fbaf04328c161cf3
SHA1 72e3ac23fc57c704fac540c04c1831a0e0349ab5
SHA512 657f918d5da2ff66db506500ec6b5826fef0d3ed261581b69da9c298faeca33135113edb5dc0f185c276f14efe6bde0aa208b569cf384a9a2f109544c8c8729c
SSDEEP 1536:jTrliJeXfDGi13guzGrEvsHfbY1LpCZiqot4BHmQVI41i8mLR4ducyD3M2VWxPn9:j3lp13guzhLFb4qMmLWd63Tq9
TLSH
T1BEB3AFF7DFB68A2854FFD4286A83C43EFD262454F3673009C863672152C6B786779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 fffd71dbd3d89605d21f4bd77529c5a37b6ab5e28bf2302910424ba8dc37a479
MD5 3b096b874c41a7c28febcbb89efafc17
SHA1 8dea298c42ae12c170d6f6f43ce3af6c0b56ffc3
SHA512 44b314c2b4c0c0bb5896b5256b3c8966556c3e8e23c54c1c55ed75e4ab470bf6a80f604f9a09fae318e1d667348ad8efea3c21580fe50072a64d8fbf8494fc14
SSDEEP 1536:XTrliJeXfDGi13guzEeNrw7WGLOZZcRP9dmet4BHmQVI41i8mLR4ducyD3M2VWx0:X3lp13guz9zFeD4qMmLWd63Tqc
TLSH
T12EB3AFF7DFA68D2854FFD42C6A83843EFD262414F3A7301DC863632562C6B786679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD2F3.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hmfvoyx3.pjk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hmfvoyx3.pjk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cab18DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab18DF.tmp
Size 1.8MB
SHA256 8af4c7cac47d2b9c7adeadf276edae830b4cc5ffe7e765e3c3d7b3fadcb5f273
MD5 53c5f45b22e133b28d4bd3b5a350fdbd
SHA1 d180cfb1438d27f76e1919da3e84f307cb83434f
SHA512 46ad3da58c63ca62fcfc4faf9a7b5b320f4898a1e84eef4de16e0c0843bafe078982fc9f78c5ac6511740b35382400b5f7ac3ae99bb52e32ad9639437db481d1
SSDEEP 49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
TLSH
T1E095337AB7F894C0F8B22D3483B959DEA83C07517E291121F9E236D44942FBE9B4BD44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1D27.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab1D27.tmp
Size 1.0MB
SHA256 4c3b008e0eb10a722d8fedb325bfb97edaa609b1e901295f224dd4cb4df5fc26
MD5 bf95e967e7d1cec8efe426bc0127d3de
SHA1 ba44c5500a36d748a9a60a23db47116d37fd61bc
SHA512 0697e394abac429b00c3a4f8db9f509e5d45ff91f3c2af2c2a330d465825f058778c06b129865b6107a0731762ad73777389bb0e319b53e6b28c363232fa2ce8
SSDEEP 24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
TLSH
T16F3533CF8E8A90C1CC07D4717AA9FFE77C29A7832B67D192B7049A4109EB7D1E9461C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2140.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab2140.tmp
Size 931KB
SHA256 8b0631da4dc79e036251379a0a68c3ba977f14bcc797ba0eb9692f8bb90ddb4d
MD5 d4eac009e9e7b64b8b001ae82b8102fa
SHA1 d8d166494d5813db20ea1231da4b1f8a9b312119
SHA512 561653f9920661027d006e7def7fb27de23b934e4860e0df78c97d183b7cebd9dce0d395e2018eef1c02fc6818a179a661e18a2c26c4180afee5ef4f9c9c6035
SSDEEP 24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
TLSH
T1CC1533ED199B2F9FCAE72C808550CA568C3BD6C70D40D6BA20E6D7A91CD2783977C44E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab3363.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab3363.tmp
Size 3.1MB
SHA256 42323dd1d3e88c3207e16e0c95ca1048f2e4cd66183ad23b90171da381d37b58
MD5 8867bdf5fc754da9da6f5ba341334595
SHA1 5067cce84c6c682b75c1ef3dea067a8d58d80fa9
SHA512 93421d7fe305d27e7e2fd8521a8b328063cd22fe4de67cccf5d3b8f0258ef28027195c53062d179cd2eba3a7e6f6a34a7a29297d4af57650aa6dd19d1ef8413d
SSDEEP 98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
TLSH
T1F8E533E1ED2A706B9D125027FC6A81C524F8661A52200F8E7A70F3F5D8437D54A2EDEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab3364.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab3364.tmp
Size 1.7MB
SHA256 640ad075b555d4a2143f909eafd91f54076f5dde42a2b11cd897bc564b5d7ff7
MD5 828f96031f40bf8ebcb5e52aaeeb7e4c
SHA1 cacc32738a0a66c8fe51a81ed8e27a6f82e69eb2
SHA512 61f6355ff4d984931e79624394ccca217054ae0f61b9af1a1eded5acca3d6fef8940e338c313be63fc766e6e7161cafa0c8ae44ad4e0be26c22ff17e2e6abaf7
SSDEEP 24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
TLSH
T16A8533C4A81F428ED50B28F9F7F7E4F52538521586A0A1F84D68853FC2CBA877D7A274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab3365.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab3365.tmp
Size 1.2MB
SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
MD5 9c9f49a47222c18025cc25575337a965
SHA1 e42edb33471d7c1752dcc42c06dd3f9fda8b25f0
SHA512 9fdcbab988cbe97bfd931b727d31ba6b8ecf795d0679a714b9afbc2c26e7dcf529e7a51289c7a1ae7ef04f4a923c2d7966d5af7c0bc766dcd0fca90251576794
SSDEEP 24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
TLSH
T1B555339086720887C8F78DE15E36C871FD56ABC279D9520E06B2665BE8B3BD1F046C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab3366.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab3366.tmp
Size 2.5MB
SHA256 a44166f5c9f2553555a43586ba5db1c1de54d72d308a48268f27c6a00076b1ca
MD5 beb12a0464d096ca33baea4352ce800f
SHA1 f678d650b4a41676ba05c836d462f34bdc5bf648
SHA512 b6e7ccd1ecbb9a49fc72e40771725825daf41ddb2ff8ea4ecce18b8fa1a59d3b2c474add055f30da58c7e833a6e6555ebb77ccc324b61ca337187b4b41f7008b
SSDEEP 49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
TLSH
T15EC533D70B1044037486A8AF711197821FE58AC63EC491CF38BA999F0D6DF4B5CDDA6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab34C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab34C1.tmp
Size 2.4MB
SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
MD5 f256aca509b4c6c0144d278c7036b0a8
SHA1 93f6106d0759afd0061f73b876aa9cab05aa8ef6
SHA512 08c57661f8cc9b547bbe42b4a5f8072b979e93346679ade23ca685c0085f7bc14c26707b3d3c02f124359ebb640816e13763c7546ff095c96d2bb090320f3a95
SSDEEP 49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
TLSH
T10BC53364C05D3B0180DB8A007771A587F2FCAE5BA6147FB54F4C9D2518AAEF26E48FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab5DC.tmp
Size 537KB
SHA256 4e2e93ebac4ad3f8690b020040d1ae3f8e7905ab7286fc25671e07aa0282cac0
MD5 1c12315c862a745a647dad546eb4267e
SHA1 b3fa11a511a634eec92b051d04f8c1f0e84b3fd6
SHA512 ca8916694d42bac0ad38b453849958e524e9eed2343ebaa10df7a8acd13df5977f91a4f2773f1e57900ef044cfa7af8a94b3e2dce734d7a467dbb192408bc240
SSDEEP 12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
TLSH
T11CC423674BBC3A929EC5A522176FE093EE72DF05E601E01B51AC4C8710E6FDE1DC524B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab7A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\cab7A3.tmp
Size 225KB
SHA256 6a3801c1d4cf0c19a990282d93ac16007f6cacb645f0e0684ef2edac02647833
MD5 93fa9f779520ab2d22ac4ea864b7bb34
SHA1 d1e9f53a0e012a89978a3c9ded73fb1d380a9d8a
SHA512 aa91b4565c88e5da0cf294dc4a2c91eaeb6d81dca96069db032412e1946212a13c3580f5c0143dd28b33f4849d2c2df2214ce1e20598d634e78663d20f03c4e6
SSDEEP 6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
TLSH
T1643412718CC8688BD9A56C36037DCEE7BC3977D75A11010BAA50F8E411CBBD31E2A29C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB5E.tmp

Path C:\Users\Admin\AppData\Local\Temp\cabB5E.tmp
Size 300KB
SHA256 3744bfa286cfcff46e51e6a68823a23f55416cd6619156b5929fed1f7778f1c7
MD5 0ebc45aa0e67cc435d0745438371f948
SHA1 5584210c4a8b04f9c78f703734387391d6b5b347
SHA512 31761037c723c515c1a9a404e235fe0b412222cb239b86162d17763565d0ccb010397376fb9b61b38a6aebdd5e6857fd8383045f924af8a83f2c9b9af6b81407
SSDEEP 6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
TLSH
T1B964139ED9286A87CE496D402475D4131D3DD3C92C7187CD48ABECFB5FE33935A1A0A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabD16.tmp

Path C:\Users\Admin\AppData\Local\Temp\cabD16.tmp
Size 681KB
SHA256 3732eb6166945db2bf792da04199b5c4a0fb3c96621ecbfdeaf2ea1699ba88ee
MD5 e29ce2663a56a1444eaa3732ffb82940
SHA1 767a14b51be74d443b5a3feff4d870c61cb76501
SHA512 6bc420f3a69e03d01a955570dc0656c83c9e842c99cf7b429122e612e1e54875c61063843d8a24db7ec2035626f02ddabf6d84fc3902184c1eff3583dbb4d3d8
SSDEEP 12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
TLSH
T1C9E4236D40A6E1D3B96364B4DF58F6D7AF05B36C97881A04405A82D019CF367EF7E03A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 285B
SHA256 2b17dfd519267a7dcedc457f0ae425e1355a41d6a3e2401bb0a5d67c88621119
MD5 6376fd12eeecd06e2352927c6bdee1ec
SHA1 436d11579bebd6bf118211b725184097961d77a8
SHA512 dd6ddd64bad1e0e2a7dc1f939f0d4b9998c40a1d2a42b1bafd6137918f003cc895b0ef786c946c127a8ee55e45a468e3602694bf12e7b857c5fb21f7d5f6a4a2
TLSH
T18CD0C7276312E3F8477C22483E392DE88BF28C04DA6A20101BCE0EA00CB8207B02B40C
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 307B
SHA256 a28d694dd52b6f6349980faa078885f4f6de77467bc2e68e94c33db9e623393c
MD5 542fe5a04aee4f7a0bd7b9a0a6d4fcea
SHA1 3246682bab95274ca811a0b6730e11246e1e7949
SHA512 1b2a28fabf941570470064383bf98a8a7da7efb7e5dca5b0145f424561a5a25dec693f275ef1607e2e9117ffec3bd756565e37d07cffb004d48eb44522240303
TLSH
T155E0EC676365E3F8537D11593E395DF88BF2CC14E669256416CE4FA10C78607706B40C
MD5 SHA1 SHA512 TLSH

Submit Download

YME33U5EIX5WRJW65L8C.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YME33U5EIX5WRJW65L8C.temp
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 e4c87863e1f56fd4d3349c1640a440ad0a796c07575a31f64b9cb3078cba9d1c
MD5 d1ad25e3358c2630acadd755cc810124
SHA1 652f2fcbf2e95db5965c957dae6513a87e74cb1b
SHA512 484e9363b1bbdc475e5891221b68620fb4fe8a6ffe6cffd5e253276c8383edf4b1271e252f4d4b7a330879bc904d59f3fc87c0793b5f8e8310c8fcd53bb77cd7
TLSH
T1A921E1049BA70D06E0D650B31A336725E730FA105B0DF79F659501271C7EE40AD4AB97
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 0db179e489de53bfa2e47b625a1f8e10f69cfcb0434898c3ef4f4a5513a10e29
MD5 1fddf5d231044bb1d2713434b7f6bdae
SHA1 22b82d887839963f03009f8251d1ed7dc33f2874
SHA512 abfc954eb6115ab3766bcec8a9d6888b0629f042c50aba2584a66eacd877fcd3ac8bfa071b1b7e5b863a0163d1dd086605a95aaa8dcb12b9cf4459a7a956ab8a
TLSH
T1EB4104045BAB4D06E0E581B319336725E730FA006B09F79F668901271C7DE41AD4AF57
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 6b22ac7485c5a3d253a354356902c1c0cde4daca668f53d77d4912dd55bcbc79
MD5 49118bfd20b779474286b67cd82f9bd9
SHA1 fcc928dd8f4ac7fac2355a0b0877d52a7ae6463b
SHA512 1121f58e43ca589a9adc79a5251e47a2790e4bae8662de81828c6a6da58d8ad2e64b44527b578f6db72756d69be343849891d8c376c7f97fa1bc4e638e481dcd
TLSH
T11D51EE06DBAB1F2BE4A243B5913B5728D2B43C05EA4C624DD68A1437BCA8D009D0DF9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 858129439d8fc2bd0b68562fe8470a9c82a6ea98948de9800331045ce7a9f53f
MD5 8a5eeb5c273f8637176f1a877fb49cab
SHA1 7efca9ca329a13034c348be698c232a106e2a291
SHA512 56f81988aa35073b07e03d9e7e625bd6aa78454d317eea7c59851ce859d8ade5b8b41cc6be99a1fa9dee483eba0b5a1818ac517a82c475d8be18e8b2d4ffb250
SSDEEP 192:eOv5zbo8MBjyj7cM1d66JoztdzgCl6mc0dz:1bo8MBjyjrd66Joz/zgC1jd
TLSH
T183D11E68FA28863FC008427BCCA11F410F39395B984E7F6976AD60082C576DE769D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 5148dc3aac3aec068c7d7a3d5aa60f0807b4d99f3ee61479ac9e914bffcd505a
MD5 979df33dce49a755d626bd406e3d8f1e
SHA1 f0f9cd9c6141ef2e2ff02be01305707b2599e43d
SHA512 9b52e18f278660ffda3f0417df55203023318e37bcc3ceea31e325f8dd09e8164bdf7845a1dc4930aed4cf99db0f5cd12bed816fb3f824ed4beb28e3a9bed1c7
SSDEEP 384:hd66Joz/zgC1jqdCrvXsLmtGcm+ufggCKDFAVUbZb8DZborBjyjU:u1Md0VtGcm+u4lKDFAVUbZbg5k/
TLSH
T15BC21344FB2A963FD41552BBCCA517001F79B88A98192F973A4D646C2C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dfa2161a5a2fbea56b51fa385d718339cb97cf7be090d596f5de1d1a3ef02449
MD5 0acdd57cb48fa82a73da274ccc0be76f
SHA1 daea3a62dce7866f56775a8203dea0e33675dafc
SHA512 816b88807a1c790017985ad7b4304dcc166fb6b46707bfdda47a13195489d6ad807af63979cd90aef14c558a34bff9d0d14ff67ff626833028ad83e39bce8efd
SSDEEP 192:dOv5zbo75ZBjyj7cM1d66JoztdzgCl6mc0d:SbotZBjyjrd66Joz/zgC1j
TLSH
T1F9E12168F629863FC018027BCCA21F410F39399A9C4E7F6976AD601C2C576DE369E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 51c2fdde3ce3a925a311223d5542080d8588ec7e6053929adff714f77b7e445f
MD5 09392a25d4a3d7e1f2b9ea4d4f5e9545
SHA1 b79c2080b71139bd94719ada8b5cf22c700c874f
SHA512 a48d0ea593c20ff884500016b0dcf9a44e28fafce66a0fd899a0741a1946f0cf0900d55a6f1205deb48d58afbd77e12d98797a5d519e00a9e689e7c00bac8222
SSDEEP 384:9borBjyjrd66Joz/zgC1jqdCrvXsLmtGcm+ufggCKDFAVUbZb8D:9kr1Md0VtGcm+u4lKDFAVUbZbg
TLSH
T1C2C21344FB2A963FD41552BBCCA51B001F79B88A98192F973A4D646C2C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 30390e4b8e022112a83c2539d1a74ecd273a996decae9cce9c218d6cee99d290
MD5 51a59e1dfbff642af1a68143732bb9ae
SHA1 08b5c301562de0412f4ec4f686ce4bffc6ae01e8
SHA512 e68a936205cecc5828a9fd7e4714db5233cc6282f5f6031df3cc2faa008132bca730ad2bef47fe8a540173483ee5b164136230c7aab03edeb69857850ee5266c
SSDEEP 384:hd66Joz/zgC1juborBjyj7dCrvXsLmtGcm+ufggCKDFAVUbZb8D:u1UkMd0VtGcm+u4lKDFAVUbZbg
TLSH
T141C21344FB2A963FD41552BBCCA51B001F79B88A98192F973A4D646C2C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 adc3e91559c28f9619293be2bf0eb3d2020764127ce6754bf9b3dfded045f2d0
MD5 cf745a74ff94a7249635ec4b8382b37b
SHA1 7713907c09b96f733b53b7bdc072c7ccef8dae75
SHA512 b2e1371ce8f6381290e7bd4416b0ef531acd84ccd373503724aa1f1771c0ee83786504bac5289dafa953467f84f7bea0fac175ee06acc5a9a343ef1cec690de3
SSDEEP 384:RdCrvXsLmtGcm+ufggCKDFAVUbZb8DZborBjyjrd66Joz/zgC1jd:Rd0VtGcm+u4lKDFAVUbZbg5kr1/
TLSH
T159C21344FB2A963FD41552BBCCA51B001F79B88A98192F973A4D646C2C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cdefe97fcc129263959593366d7e2f608170a1ac52a6f63c17e92f83f51d91bf
MD5 1a464421a8da46bc7e287cad50adc661
SHA1 b3af3b895ba458e76f6ecfb20d7bc4aab3ea2857
SHA512 64d449b7f3d2237a09692c3eb5afd58a9e3c56f8e0ca70d97da329a85d8cdc29e6ae7626a8b1e7f8aa99c614bcff53ca28aa0118bb7a0fefc2f14ba3148666d0
TLSH
T16A216A4C3BB84D2A9CC7E79C78C202CE53D54A4B24871C431D82DE8DCD95ADE31AA538
MD5 SHA1 SHA512 TLSH

Submit Download

2d52dbef-23f5-49e9-82f2-eed91560bdce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\2d52dbef-23f5-49e9-82f2-eed91560bdce
Size 886B
SHA256 7dbfe22fa27fb90953fd11db073515c4af2709300080e8bebe9b5f682a0a54ba
MD5 8177ee9607729ec101b0f029b2a01662
SHA1 0574254c560f5b27c4901a1fdc5f0731cc5409aa
SHA512 acac910d139c33da501833c5b8f3df1ec93df4f91bf5e77ba644fff5c43ad433f6cca82705aa8d4738a35309fc58c97a2d3f3f464eb27193890fedccf88fd1de
TLSH
T1C8112744E675B5728C3CD29B85D13B8747D83133C0C64A687FA09B180DB9A1E67B2307
MD5 SHA1 SHA512 TLSH

Submit Download

3e976f06-8327-497f-8e85-e1c576632376

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\3e976f06-8327-497f-8e85-e1c576632376
Size 235B
SHA256 52d1f1643d820447a25019ce38034b57a2c5e4b6963c7fc64be19bdc2313d294
MD5 bfdc0ec4fce56c0c9c9c9388a161b086
SHA1 90488b38b4f552cbf1f400701fdfb004e20368ae
SHA512 81bbad28d71501461d8cba35b3de590455131a0c2db91587e15860a126991cae14de4117fb79b111fdfd091024895df83a8150171050ef9974249c00e54f5d07
TLSH
T195D0978828C83F6C08004F07B0B0ABC330868C3350789C20D6504674A9FDDC88191DAA
MD5 SHA1 SHA512 TLSH

Submit Download

7e5c98eb-965c-4441-9eb9-2035f7d94ac0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\7e5c98eb-965c-4441-9eb9-2035f7d94ac0
Size 883B
SHA256 885789b818def63e34d515f9fb7ef838e840ed6c06d36a4b83f8a52c373c19c3
MD5 1a284d8d09b2fc7677c3ed244b1d3fa3
SHA1 07c390662a77a1b43db9c5c32b63979d151e99a4
SHA512 7878820fc7b813b6be64777252dc5f21d56bd4a79e0c9e0e969c40294ab7c4b451ae129a96f06227865ef4b87e36ecd4bc767f0c209536a37a32d527bc41b571
TLSH
T13D110440F77176B5CC28D28F85663B4247EC353380C595187EE18E080CBEA1E6776207
MD5 SHA1 SHA512 TLSH

Submit Download

d40ef736-80e9-455c-bc5a-9f10c62e4716

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\d40ef736-80e9-455c-bc5a-9f10c62e4716
Size 2KB
SHA256 7fbf1dbe35db95e7d2c740b6e4ae252e83c9c1db8be11f0f5086ef56f0495d2b
MD5 188c6690ec3bd9d0f58c3a71b4af5a07
SHA1 3225148f87b82825a5d9376d956786f8c29b581d
SHA512 02c7b7963cc8f0e274e8daff635e844e55d2476d7b7176a163530316213636e09c041ce584a7da135e2b32b2b03a581fd302c48856e8ae074630ded53ae90b0e
TLSH
T1A241516C75784C7A5CDAF58C9481278F43748E1304C72C832EA1DE0CCD87A9E23BA52A
MD5 SHA1 SHA512 TLSH

Submit Download

ef34eef0-277d-4a28-94e4-090ec1c29708

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\ef34eef0-277d-4a28-94e4-090ec1c29708
Size 2KB
SHA256 6b2991da1d2fbb79a354b0a16ead3659d661696a7ab690edeb47aa18cf0785fd
MD5 9b1ecceefd8ff0fd53defb35f00521ef
SHA1 13d1e6eddb81bd2c4d01dc4322707f14e3085d92
SHA512 38a75e45851321e781210b0c2318427b5a9d421d8b314ff68cb12bd61ba6ab2de0d2d0e39f65efa08d113150aee6462c6f8f1ea42e036b80365fabebb40e7c16
TLSH
T1385195299160D87DC87DB31ADD243B838BF6141B408B295EAFE8AF0A117FD0E9365605
MD5 SHA1 SHA512 TLSH

Submit Download

f6c7a7f8-1943-4510-93f1-782c0b180e22

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\f6c7a7f8-1943-4510-93f1-782c0b180e22
Size 235B
SHA256 2515c329af8334895f6a2e778da4bf3e5b7f50c57d49a6a02befc8eaca95181d
MD5 debc481f78a194dd4b92d76f0a1d9a0d
SHA1 7a6432f0f75dddf3f017490232f5e860a577473d
SHA512 d7a97fa47ba8dba108b58e75b0957396c7fc603ba11ccac7fc6fc2faeb9f52b8f976718f7b7afc5280810403f4d9f16831528daa70de3fac100df8e6e638e8a7
TLSH
T1B5D0978124E8B76E0C180F27F0E228C230958C3310A8BC20855541388ABDAC441A281B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\extensions.json
Size 16KB
SHA256 9c56d6dca781c74d46d7e048a19336d0199c25c55641dc194d77a5aaceb7f0b5
MD5 6ccffd68955a00d8dedc0c01921b752c
SHA1 469e1c42b8d78c902d0ab843d12cd65f5b3922bc
SHA512 6d1ae2067cd485c8fc7e6ee7acb5dc30f5636cdff9cc380145962892f2a36c92ddc14d0cc883b5fb4bf459918a392b2c3d6ea8b04a1eae1da615c0a49a090bc9
SSDEEP 384:DnkI4v7Umldvt8dhW294ze96omL4HeAL4PoL4HOL4HrL4Hwb4hg:DkI4zRfeXn4m6L4+i4C4U4X4i4e
TLSH
T11E72521545049EB8294FA78AAA367E02C37D473B60855C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs-1.js
Size 6KB
SHA256 f561f8355f55c048a9a268eb00187dcee1572c971d3414d7a2d6b6c03ff98058
MD5 9fe375ccb4b7a7d399c2ddfb2e5f131f
SHA1 fa8cf79e5d57c87582dce34b0558443947f18fe9
SHA512 664c9c3f4779bdc4911130af691463577a079d8dee452ce2c7e13ce4c31ce22fed74143a29a8e5d1d01957e3dd16f0be17ca6eabd72aa64c44d0a5f6005d6768
SSDEEP 96:xHcUTUcoqGqmJff5q81zSyZdSSledv9jjnkHUdEBw88u8L4cn9tgT:2iRmNf5q8zbSSVUdEBw88/Y
TLSH
T17AE11F7894088B7F64B677AC6C6488715AB2013BBBBF68D750B65485050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs-1.js
Size 6KB
SHA256 755f77f4b19db6c5bfbf0d142729074f5e6bbd52ff55a31fc0130aa5713610d6
MD5 b95019a8ea2d634fb9ccfe8ebc28d8cf
SHA1 64215d5b71f31aea87a10b58eadcfd0ead3507af
SHA512 f1afdf5ad2eabaac1526dfcede7bbb468b8d220b51257169802344ccb3440b0fb5a90853821f21bb957f40eeba89194c91cab6b15c784dcec23be859a31176f1
SSDEEP 96:xHcUTUcoqGqmJff5q8ObzSyZdSSledv9jjnkHUdEBw88u8L4cn9tgT:2iRmNf5q8YbSSVUdEBw88/Y
TLSH
T174E1207894088F7F64B6776CAC6488715AB2013BBBBF68D750B654C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs-1.js
Size 8KB
SHA256 d93f4d352396bb9066a7a261ca4758e57af38b2d6d4c4ea657d875e088886536
MD5 42ab7f7d5828e58eca43bbc135a3af96
SHA1 6aef25dcf1f633ed6851df4e8fdc0e849b1c7a0c
SHA512 fa027893b91e85f9d7eded3612d846c46ad68897cbedf459c87e024660c43786081845963f9de74f0db4130a664d496c36fb726d7ae0dcdcca513489604e2622
SSDEEP 96:xHdpTUcoqGqmJff9q8ObzSyZdSSledv9jjnkWRi4dj/AOBw88B8L4cn9t+T:HDRmNf9q8YbSSERBd8OBw88Si
TLSH
T114022D385508CF7F69B677ACAC6488715AE2013BBABF68C704AA54C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs.js
Size 7KB
SHA256 6c57c858f12dcd623d57992014ed50b4c1fd008c562b0f0303e57148bab486d0
MD5 80d07666e63d5b2bf3cad0e95054abd9
SHA1 efb98ec4eb76452faff61bb9f82cdda9efc18249
SHA512 00d091afce8d8a418cb5412e08d6a20fdc7516afc90f8f35c51b8c3a48fc2073425b4968c28c63bfe319cb29b3e6109cf1d112536789c57541b2273f8415414c
SSDEEP 96:xHdUTUcoqGqmJff5q8ObzSyZdSSledv9jjnkHUdnBw8828L4cn9tgT:HiRmNf5q8YbSSVUdnBw88XY
TLSH
T15FF11E7895088F7F64B677AC6C6488715AB2013BBBBF68D750B554C4010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs.js
Size 6KB
SHA256 80581e959daa208e0a3c9d79a78730bfb6cb95c0d564dfa9c71ebff27eb13fda
MD5 6cfb387738f011bbb34be5755a873bda
SHA1 25990026d1021a65e3c8e2ed7d8dc5e88769c57f
SHA512 bf2e4c1ba408d75f42f0a549827b2560032c73b0d007b2ffa4c89247d0de4c773e243d0ad82cb5a130ab692e39ef4aa45a41e61807c594be500b261ce3d25007
SSDEEP 96:xHcUTUcoqGqmJff5Zd1zSJSSledv9jQl5nkHUdEBw88u8L4cn9tgT:2iRmNf5ZdISSJCUdEBw88/Y
TLSH
T101E1207894088B7F64B6776C6C6888715AB2013B7BBF68D750B65484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs.js
Size 8KB
SHA256 ab261f56115bd394654acdc0a74fdcc00587521e0d8ad6f3c7e0194a1721f12e
MD5 65dd959e60de4e01496cc8abc3802375
SHA1 db866a73c34787ed7c5a8c1c1f302dcfc353b611
SHA512 5d97694b2a0eda58c92ee3187daebab93e945200d28ca5adf8085d5c7f343f26601a1c573e5ba85b788f5e98215ec1879ddc1763bb551f32186afdcae9907201
SSDEEP 96:xHdpTUcoqGqmJff5q8ObzSyZdSSledv9jjnkHUd3KBw8828L4cn9tgT:HDRmNf5q8YbSSVUdaBw88XY
TLSH
T11002FB789508CB7F68B677ACAC6488715AE2013BBBBF68D740A954C4050CF3542F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 012b009c24e832154863edb415faea6f5764dc9d24845f560317c6b0cfb195ff
MD5 5863cc941a7a7b3895018892bf0c71d0
SHA1 5907642b24d220622b8f8654a6de5e8c6f8eec8f
SHA512 f9f698100383f3df586999f97dd9eb11a9222f3666074f7d61fa9dd98091cb1ace251766e33baffa20a6f8f6ac9941bb441293404ea29f6d3b20687d00219165
TLSH
T1BF21CAB7CEFB0FB56E554222D44D4FE285D62031C4B564F0905DCA8252ED91D33C6328
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.2MB
SHA256 615484e1a88169e2d9b51375dce983e54e96839d16e514c9b33642f2e8c3d550
MD5 d8539526c235d677ca6615dd21d3c77e
SHA1 46786ae595f8c6dfbd068427c76ce963ac6a3708
SHA512 804d60c5b5b8ed7ecc088d1172bfdc3d7e69b8a488cb5cad99064f9cbd61acd541baab1bdd8a51bf971fe3b7201db7f7854a5c2f34e0643268022d877ebe6998
SSDEEP 24576:6iuC5ypzao2AsjDsmY88/rF4NGPdbYhIoKyHNJCdUSgl6iPwTxJTqcdHV:6iuL01PsmY5laxKyHrC2Sgx8x7
TLSH
T146462AF820D1A297F3414033664593EF21EFD00C6027DA085BE95AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.7MB
SHA256 fea0efb9d8a1e4fa948dad03d2d0eaa95bda01f50026b23a8dce31f79a96d5ab
MD5 6ead57a28f400fa1f532b9e69d157774
SHA1 ab05f4c0da287f88f3262c5bffb0a62d6c3dadf2
SHA512 63a442e76e028f01fc714d2731eaac10657e3913f90672b4a4919abe72379ae90fabb234d61536d23f457abd54929689e3ee672c10426fad988010742125cd9e
SSDEEP 49152:9iuAsJ+8sL2DQKyHrMMSgPELc70jfx+wSg:A92DQKyHrMTqFSx+g
TLSH
T1CCA62A9560D4EA92EA008676F30B43DB767FC1CC2096C59416F86EA858636DFFE2F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.5MB
SHA256 8ee1c949edb8e1d073d8bc61f7364f1a1c53f5163631124cdd6da004ea88fd3c
MD5 8999783aade98c0886f6019b692f9330
SHA1 395f094ec3bbab41506f5fbfe15071077f569f55
SHA512 b64503fffea72ac97928b7c8bc50bd6eccd5401f0051ecf4e54639c8aa82b1ea217eaf7e97b3ccaa9c28b31ccd6418b6128b26f2b55abf7156001e277c9c0f99
SSDEEP 49152:dlaz+3F3+lsoA98GHCWqRxgTx75k8jfxz8BMqho5C8RC:zqA98GHCWqnmxvxz8+os
TLSH
T1E2E63A5670D0DA92EB0186B2F30F43DB317FC1DC20E6859416B8BA5C59636ABEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1082.tmp

Path C:\Windows\Installer\MSI1082.tmp
Size 418KB
SHA256 f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40
MD5 67f23a38c85856e8a20e815c548cd424
SHA1 16e8959c52f983e83f688f4cce3487364b1ffd10
SHA512 41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d
SSDEEP 6144:7P8N0LW3qa54J725UZnEuru4dtN5dHak+KNlA0ZBoWENFw2IzuJAgXrCUlZy1O9a:78mLPa5S72qVRLHak58py0s
TLSH
T1AE94064177E55030F2B76B31AAB989224E7BBCB1A9B6C00FD3854A0F5971A40FA35773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI115E.tmp

Path C:\Windows\Installer\MSI115E.tmp
Size 148KB
SHA256 6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164
MD5 be0b6bea2e4e12bf5d966c6f74fa79b5
SHA1 8468ec23f0a30065eee6913bf8eba62dd79651ec
SHA512 dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b
SSDEEP 3072:oitbxNeB4Ms+eGDIEZvtFg1Ass+wrQiVntHY:vTKME3eWhY
TLSH
T13CE35B0273D09071E5AF027A2574AA251B7FBC72DB7189CBF7980A5E59706C0BE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI12E7.tmp

Path C:\Windows\Installer\MSI12E7.tmp
Size 209KB
SHA256 5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b
MD5 0e91605ee2395145d077adb643609085
SHA1 303263aa6889013ce889bd4ea0324acdf35f29f2
SHA512 3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be
SSDEEP 3072:nAhQzCk1xLP3JBy9H00pSx71cIUrdfcr1DZJq8aK:AhQzCkXLP5o/Sks9LaK
TLSH
T1F0246A1176D58035E1FB0272467AAB0206BEBEB15B72CDCF6BD84D4D1A349C1A73A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2ACD.tmp

Path C:\Windows\Installer\MSI2ACD.tmp
Size 271KB
SHA256 5ded99991217600ebd0b48f21c4cd946f3c7858f07d712fcfb93f743faa635ed
MD5 f88c6a79abbb5680ae8628fbc7a6915c
SHA1 6e1eb7906cdae149c6472f394fa8fe8dc274a556
SHA512 33e150822331356e1cdcbff824b897ca5bf2bed0345d2fa39cf9b1f36a77201167819761b1cc3b6cb02a87625e0b6b85a8505281ccc575ca6b73af68e1e90361
SSDEEP 6144:enPBENm2eK7mnoUSgpAY8ODcDcm7cIslDR+rHu7aySGx4qAOn0y9:ePZR+rCnx4qz9
TLSH
T173449E113582C43AD4BF413409798BAA867DB9300F74C5EBE7E81E6D4E332D26B35A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF19.tmp

Path C:\Windows\Installer\MSIF19.tmp
Size 57KB
SHA256 6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27
MD5 c23d4d5a87e08f8a822ad5a8dbd69592
SHA1 317df555bc309dace46ae5c5589bec53ea8f137e
SHA512 fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b
SSDEEP 768:A0J8+QCTqaHxKkUmrVSarTJym3OZESrccFK+iLwK8Ec:GCTq2ttpDJT+lcMiYT
TLSH
T132436C127AD104B7C6CA4B3164E29F2B9F3F7A541FE114839F71499A2E367E0533A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDXFile_8.ico

Path C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico
Size 340KB
SHA256 c5ba5c23decaa64a9176f20f8b18a8c89b42ed54f55f3285bd400fd74051e37e
MD5 d07cea5fbf17f2ffa4fdcb38e395dbaf
SHA1 c0218a4f53428d71f19f1121b8532b3fe0d178b9
SHA512 98ad990280e9db23ee91e23ee5d0ebc8e289eed7923cd07bb31b845af28ebe0a09bc49f9de2c7e81a49a041d9f87f089a4a67402e1182c41e0d41a3e47264d4f
SSDEEP 768:JMAyYdTmPJbgqcnDcS5SpHhD99URJ7o+m:J1U81cJpr+m
TLSH
T1C7740E24B5EEC2D2D08B38B2ED48B1F415A92E0AED719C5FBE503F89357271845B1CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-2508-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/972-2507-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/972-2511-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/972-2510-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/972-2509-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/972-2514-0x00007FF982D70000-0x00007FF982D80000-memory.dmp

Download

memory/972-2512-0x00007FF982D70000-0x00007FF982D80000-memory.dmp

Download

memory/5080-5983-0x00007FF9ABB80000-0x00007FF9ABBB4000-memory.dmp

Download

memory/5080-5982-0x00007FF714EC0000-0x00007FF714FB8000-memory.dmp

Download

memory/5080-5984-0x00007FF9390B0000-0x00007FF939366000-memory.dmp

Download

memory/6824-5528-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5536-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5537-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5530-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5538-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5535-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5539-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/6824-5540-0x000001DAED860000-0x000001DAED861000-memory.dmp

Download

memory/7024-5824-0x000001855DED0000-0x000001855DED1000-memory.dmp

Download

memory/7024-5242-0x000001855DED0000-0x000001855DED1000-memory.dmp

Download

memory/7024-5688-0x000001855DED0000-0x000001855DED1000-memory.dmp

Download

memory/7024-4829-0x000001855DED0000-0x000001855DED1000-memory.dmp

Download

memory/7696-4755-0x000000001E1F0000-0x000000001E6D6000-memory.dmp

Download

memory/9900-4616-0x00007FF943C60000-0x00007FF943C92000-memory.dmp

Download

memory/9900-4614-0x000000001DD50000-0x000000001DD82000-memory.dmp

Download

memory/10428-5028-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5938-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5199-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5511-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4891-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4852-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5029-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4929-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4815-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5683-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-5025-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4943-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10428-4952-0x00000232D6D80000-0x00000232D6D81000-memory.dmp

Download

memory/10640-5113-0x0000000000E00000-0x0000000000E74000-memory.dmp

Download

memory/10640-5280-0x0000000035BB0000-0x0000000035BC0000-memory.dmp

Download

memory/10640-5273-0x0000000035BB0000-0x0000000035BC0000-memory.dmp

Download

memory/10640-5255-0x0000000008B90000-0x0000000008BFC000-memory.dmp

Download

memory/10640-5256-0x0000000008B40000-0x0000000008B4E000-memory.dmp

Download

memory/10640-5244-0x0000000008D20000-0x0000000008D2A000-memory.dmp

Download

memory/10640-5201-0x0000000009930000-0x0000000009952000-memory.dmp

Download

memory/10640-5127-0x0000000007FF0000-0x0000000008366000-memory.dmp

Download

memory/10640-5126-0x0000000007D40000-0x0000000007FE2000-memory.dmp

Download

memory/10640-5124-0x0000000006530000-0x000000000657E000-memory.dmp

Download

memory/10640-5123-0x0000000007980000-0x0000000007D3A000-memory.dmp

Download

memory/10640-5121-0x0000000005B40000-0x0000000005B52000-memory.dmp

Download

memory/10640-5119-0x00000000066A0000-0x0000000006858000-memory.dmp

Download

memory/10640-5120-0x0000000006860000-0x0000000006BBB000-memory.dmp

Download

memory/10640-5114-0x0000000005840000-0x000000000584A000-memory.dmp

Download

memory/10884-5194-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5217-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5550-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5558-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5610-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5662-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5333-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5320-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5303-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5262-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5234-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5562-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5193-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-6135-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5884-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-4894-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5917-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/10884-5934-0x0000018EF7CD0000-0x0000018EF7CD1000-memory.dmp

Download

memory/11068-4880-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/11068-4881-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/11068-4882-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/11068-4883-0x00007FF985060000-0x00007FF985070000-memory.dmp

Download

memory/11144-4899-0x000000006F390000-0x000000006F3A0000-memory.dmp

Download

memory/11144-4897-0x000000006F390000-0x000000006F3A0000-memory.dmp

Download

memory/11144-4931-0x00000000028A0000-0x00000000028AA000-memory.dmp

Download

memory/11144-4918-0x0000000004FB0000-0x0000000005042000-memory.dmp

Download

memory/11144-4914-0x0000000005570000-0x0000000005B2A000-memory.dmp

Download

memory/11144-4910-0x0000000000440000-0x0000000000470000-memory.dmp

Download

memory/11144-4896-0x000000006F390000-0x000000006F3A0000-memory.dmp

Download

memory/11144-4898-0x000000006F390000-0x000000006F3A0000-memory.dmp

Download

memory/11144-4900-0x000000006F390000-0x000000006F3A0000-memory.dmp

Download

memory/11252-6055-0x000002B26AFD0000-0x000002B26B008000-memory.dmp

Download

memory/12224-6106-0x0000000007A60000-0x0000000007BD8000-memory.dmp

Download

memory/12224-6212-0x0000000009430000-0x0000000009438000-memory.dmp

Download

memory/12224-6120-0x0000000007A20000-0x0000000007A2E000-memory.dmp

Download

memory/12224-6045-0x0000000000E40000-0x0000000000E7A000-memory.dmp

Download

memory/12224-6190-0x0000000008DC0000-0x0000000008E26000-memory.dmp

Download

memory/12224-6191-0x0000000008EA0000-0x0000000008F06000-memory.dmp

Download

memory/12224-6108-0x0000000007930000-0x000000000797A000-memory.dmp

Download

memory/12224-6121-0x0000000007C20000-0x0000000007C5E000-memory.dmp

Download

memory/12224-6111-0x0000000007D40000-0x0000000007E94000-memory.dmp

Download

memory/12224-6237-0x0000000009E30000-0x0000000009E4E000-memory.dmp

Download

memory/12224-6239-0x000000000A270000-0x000000000A2BC000-memory.dmp

Download

memory/12224-6053-0x0000000005830000-0x000000000583E000-memory.dmp

Download

memory/12224-6288-0x000000000A330000-0x000000000A3A0000-memory.dmp

Download

memory/12224-6337-0x0000000009380000-0x0000000009388000-memory.dmp

Download

memory/12224-6052-0x0000000006BB0000-0x00000000071FA000-memory.dmp

Download

memory/12224-6350-0x00000000093C0000-0x00000000093C8000-memory.dmp

Download