Overview

overview

10

Static

static

1

ChromaCam-3.2.2.0.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    361s
  • max time network
    372s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-04-2022 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ChromaCam-3.2.2.0.exe

  • Size

    254.7MB

  • MD5

    1c28a7ed19329ce735831e62fe834689

  • SHA1

    e3a7bfffddb451ed10db09d9a2cba84e2cc788ba

  • SHA256

    769807d48dcdeeecf42a024db940a90ac879bc10e9e5864d29fb339e3358d9e6

  • SHA512

    9eded222432abaa7faf334fdf69c4217cae3cb25733bc26f5925257cc1a61e2f3d7318f8dc17c43dda3129dd082736836cb1f3e6a443c2631891f1b2aea60dbb

Score
10/10
metastealerdiscoveryevasionpersistencestealer

Malware Config

Signatures

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer
  • Registers COM server for autorun 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromaCam-3.2.2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromaCam-3.2.2.0.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\CpuGenDetection.exe
      "C:\Users\Admin\AppData\Local\Temp\CpuGenDetection.exe"
      2⤵
      • Executes dropped EXE
      PID:4228
    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=true"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:428
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4556
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4524
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4296
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4260
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.145.49\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4984
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNDUuNDkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNDUuNDkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTJGRjhEODctNEM0OC00MzNCLTlCNEUtMTg0Qzc3MEFDNEIwfSIgdXNlcmlkPSJ7QTA1OTU5NDAtREMwQy00MzY5LUIyNDItRkRENDE2QUYzQzE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3NEI5QTBDOS05MEQ4LTQ3OTctODE5RS1GNjQ2MDkyMTREODl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQ3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE0NS40OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMDE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:824
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=true" /installsource otherinstallcmd /sessionid "{A2FF8D87-4C48-433B-9B4E-184C770AC4B0}" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:644
    • C:\Users\Admin\AppData\Local\Temp\DllFinder.exe
      "C:\Users\Admin\AppData\Local\Temp\DllFinder.exe" "C:\Program Files (x86)\Personify\ChromaCam\PersonifyCameoUE.ax"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1960
    • C:\Users\Admin\AppData\Local\Temp\DllFinder_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\DllFinder_x64.exe" "C:\Program Files (x86)\Personify\ChromaCam\64\PersonifyCameoUE.ax"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4348
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "sc STOP FrameServer""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\SysWOW64\sc.exe
        sc STOP FrameServer"
        3⤵
          PID:1896
      • C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe" /q
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3588
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate
          3⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_24_x64.inf
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            PID:2208
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_25_x64.inf
            4⤵
            • Executes dropped EXE
            PID:3036
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_26_x64.inf
            4⤵
            • Executes dropped EXE
            PID:2608
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_27_x64.inf
            4⤵
            • Executes dropped EXE
            PID:1508
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_28_x64.inf
            4⤵
            • Executes dropped EXE
            PID:3316
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_29_x64.inf
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            PID:60
          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT_x64.inf
            4⤵
            • Executes dropped EXE
            PID:2792
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
            4⤵
              PID:4796
            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_30_x64.inf
              4⤵
              • Executes dropped EXE
              PID:3568
            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_1_x64.inf
              4⤵
              • Executes dropped EXE
              PID:1728
            • C:\Windows\system32\regsvr32.exe
              C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
              4⤵
                PID:2796
              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
                4⤵
                • Executes dropped EXE
                PID:832
              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_2_x64.inf
                4⤵
                • Executes dropped EXE
                PID:1556
              • C:\Windows\system32\regsvr32.exe
                C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
                4⤵
                  PID:1380
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
                  4⤵
                  • Executes dropped EXE
                  PID:3464
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_3_x64.inf
                  4⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:3444
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
                  4⤵
                  • Modifies registry class
                  PID:4936
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_31_x64.inf
                  4⤵
                  • Executes dropped EXE
                  PID:4340
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_4_x64.inf
                  4⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:2376
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
                  4⤵
                  • Modifies registry class
                  PID:2492
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_32_x64.inf
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:4684
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_00_x64.inf
                  4⤵
                  • Executes dropped EXE
                  PID:1236
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_5_x64.inf
                  4⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:4636
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
                  4⤵
                  • Modifies registry class
                  PID:3780
                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_6_x64.inf
                  4⤵
                  • Executes dropped EXE
                  PID:3956
                • C:\Windows\system32\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
                  4⤵
                    PID:3388
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_33_x64.inf
                    4⤵
                    • Executes dropped EXE
                    PID:3288
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_33_x64.inf
                    4⤵
                    • Executes dropped EXE
                    PID:4244
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_7_x64.inf
                    4⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:4416
                  • C:\Windows\system32\regsvr32.exe
                    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
                    4⤵
                    • Modifies registry class
                    PID:4420
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
                    4⤵
                    • Executes dropped EXE
                    PID:4228
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_34_x64.inf
                    4⤵
                    • Executes dropped EXE
                    PID:4216
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_34_x64.inf
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:4856
                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_8_x64.inf
                    4⤵
                    • Executes dropped EXE
                    PID:3356
                  • C:\Windows\system32\regsvr32.exe
                    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
                    4⤵
                      PID:5052
                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_35_x64.inf
                      4⤵
                      • Executes dropped EXE
                      PID:3420
                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_35_x64.inf
                      4⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      PID:1972
                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_9_x64.inf
                      4⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      PID:5100
                    • C:\Windows\system32\regsvr32.exe
                      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
                      4⤵
                        PID:4468
                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx9_36_x64.inf
                        4⤵
                        • Executes dropped EXE
                        PID:1152
                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_36_x64.inf
                        4⤵
                        • Executes dropped EXE
                        PID:4768
                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_2_x64.inf
                        4⤵
                        • Executes dropped EXE
                        PID:4752
                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT2_10_x64.inf
                        4⤵
                        • Executes dropped EXE
                        PID:4556
                      • C:\Windows\system32\regsvr32.exe
                        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
                        4⤵
                          PID:4296
                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_37_x64.inf
                          4⤵
                          • Executes dropped EXE
                          PID:2080
                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_37_x64.inf
                          4⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:4612
                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_3_x64.inf
                          4⤵
                          • Executes dropped EXE
                          PID:4524
                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_0_x64.inf
                          4⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:1588
                        • C:\Windows\system32\regsvr32.exe
                          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
                          4⤵
                            PID:936
                          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_0_x64.inf
                            4⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:3936
                          • C:\Windows\system32\regsvr32.exe
                            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
                            4⤵
                              PID:5056
                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_38_x64.inf
                              4⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:4620
                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_38_x64.inf
                              4⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:3092
                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_4_x64.inf
                              4⤵
                              • Executes dropped EXE
                              PID:3220
                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_1_x64.inf
                              4⤵
                              • Executes dropped EXE
                              PID:2648
                            • C:\Windows\system32\regsvr32.exe
                              C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
                              4⤵
                                PID:3472
                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_1_x64.inf
                                4⤵
                                • Executes dropped EXE
                                PID:3696
                              • C:\Windows\system32\regsvr32.exe
                                C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
                                4⤵
                                • Modifies registry class
                                PID:3708
                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_39_x64.inf
                                4⤵
                                • Executes dropped EXE
                                PID:3364
                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_39_x64.inf
                                4⤵
                                • Executes dropped EXE
                                PID:4240
                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_2_x64.inf
                                4⤵
                                • Executes dropped EXE
                                PID:4256
                              • C:\Windows\system32\regsvr32.exe
                                C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
                                4⤵
                                  PID:1924
                                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_2_x64.inf
                                  4⤵
                                  • Drops file in System32 directory
                                  PID:1816
                                • C:\Windows\system32\regsvr32.exe
                                  C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
                                  4⤵
                                    PID:652
                                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_5_x64.inf
                                    4⤵
                                      PID:1644
                                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_3_x64.inf
                                      4⤵
                                        PID:1640
                                      • C:\Windows\system32\regsvr32.exe
                                        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
                                        4⤵
                                        • Modifies registry class
                                        PID:3584
                                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_3_x64.inf
                                        4⤵
                                          PID:432
                                        • C:\Windows\system32\regsvr32.exe
                                          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
                                          4⤵
                                          • Modifies registry class
                                          PID:5060
                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_40_x64.inf
                                          4⤵
                                          • Drops file in Windows directory
                                          PID:2176
                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_40_x64.inf
                                          4⤵
                                          • Drops file in System32 directory
                                          PID:4568
                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_6_x64.inf
                                          4⤵
                                          • Drops file in System32 directory
                                          PID:4456
                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_4_x64.inf
                                          4⤵
                                          • Drops file in System32 directory
                                          PID:776
                                        • C:\Windows\system32\regsvr32.exe
                                          C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
                                          4⤵
                                            PID:1356
                                          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_4_x64.inf
                                            4⤵
                                            • Drops file in System32 directory
                                            PID:2476
                                          • C:\Windows\system32\regsvr32.exe
                                            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
                                            4⤵
                                            • Modifies registry class
                                            PID:4484
                                          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_41_x64.inf
                                            4⤵
                                              PID:1268
                                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_41_x64.inf
                                              4⤵
                                                PID:316
                                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_42_x64.inf
                                                4⤵
                                                  PID:116
                                                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_42_x64.inf
                                                  4⤵
                                                    PID:3940
                                                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx11_42_x64.inf
                                                    4⤵
                                                      PID:4136
                                                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dcsx_42_x64.inf
                                                      4⤵
                                                        PID:548
                                                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DCompiler_42_x64.inf
                                                        4⤵
                                                          PID:4924
                                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_5_x64.inf
                                                          4⤵
                                                            PID:1360
                                                          • C:\Windows\system32\regsvr32.exe
                                                            C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
                                                            4⤵
                                                              PID:1776
                                                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_5_x64.inf
                                                              4⤵
                                                                PID:3492
                                                              • C:\Windows\system32\regsvr32.exe
                                                                C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
                                                                4⤵
                                                                  PID:1132
                                                                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe X3DAudio1_7_x64.inf
                                                                  4⤵
                                                                    PID:4540
                                                                  • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_6_x64.inf
                                                                    4⤵
                                                                      PID:3660
                                                                    • C:\Windows\system32\regsvr32.exe
                                                                      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
                                                                      4⤵
                                                                      • Modifies registry class
                                                                      PID:1516
                                                                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_6_x64.inf
                                                                      4⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2032
                                                                    • C:\Windows\system32\regsvr32.exe
                                                                      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
                                                                      4⤵
                                                                        PID:3652
                                                                      • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DX9_43_x64.inf
                                                                        4⤵
                                                                          PID:1128
                                                                        • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx10_43_x64.inf
                                                                          4⤵
                                                                            PID:1068
                                                                          • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dx11_43_x64.inf
                                                                            4⤵
                                                                              PID:2744
                                                                            • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe d3dcsx_43_x64.inf
                                                                              4⤵
                                                                                PID:2564
                                                                              • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe D3DCompiler_43_x64.inf
                                                                                4⤵
                                                                                  PID:2036
                                                                                • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XACT3_7_x64.inf
                                                                                  4⤵
                                                                                    PID:1512
                                                                                  • C:\Windows\system32\regsvr32.exe
                                                                                    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
                                                                                    4⤵
                                                                                      PID:4464
                                                                                    • C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\DX2D9A.tmp\infinst.exe XAudio2_7_x64.inf
                                                                                      4⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3204
                                                                                    • C:\Windows\system32\regsvr32.exe
                                                                                      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
                                                                                      4⤵
                                                                                      • Modifies registry class
                                                                                      PID:3188
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
                                                                                  PowerShell.exe -ExecutionPolicy UnRestricted -inputformat none -File "C:\Users\Admin\AppData\Local\Temp\linpack\cpu_perf_analyse.ps1" "C:\Users\Admin\AppData\Local\Temp\linpack" "C:\Program Files (x86)\Personify\ChromaCam"
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1560
                                                                                  • C:\Users\Admin\AppData\Local\Temp\linpack\x64\linpack_intel64.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\linpack\x64\linpack_intel64.exe" C:\Users\Admin\AppData\Local\Temp\linpack\linpack_param
                                                                                    3⤵
                                                                                      PID:2340
                                                                                  • C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe" "C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe" "/install" "" "0"
                                                                                    2⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4860
                                                                                    • C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe
                                                                                      /install
                                                                                      3⤵
                                                                                        PID:3508
                                                                                    • C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe" "C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe" "/start" "" "0"
                                                                                      2⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3396
                                                                                      • C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe
                                                                                        /start
                                                                                        3⤵
                                                                                          PID:2568
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc failure PsyFrameGrabberService reset= 0 actions= restart/0/restart/0/restart/0
                                                                                        2⤵
                                                                                          PID:4508
                                                                                        • C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\SilentExecute.exe" "C:\Program Files (x86)\Personify\ChromaCam\certutil.exe" "-addstore "TrustedPublisher" "C:\Program Files (x86)\Personify\ChromaCam\64\personify.cer""
                                                                                          2⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:528
                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\certutil.exe
                                                                                            -addstore TrustedPublisher C:\Program
                                                                                            3⤵
                                                                                              PID:4020
                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe
                                                                                            "C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe" install "C:\Program Files (x86)\Personify\ChromaCam\64\psycamera.inf" PSYCAMERA
                                                                                            2⤵
                                                                                            • Drops file in Windows directory
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1988
                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe
                                                                                            "C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe" restart PSYCAMERA
                                                                                            2⤵
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2204
                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe
                                                                                            "C:\Program Files (x86)\Personify\ChromaCam\64\devcon_x64.exe" rescan
                                                                                            2⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:208
                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\Personify ChromaCam.exe
                                                                                            "C:\Program Files (x86)\Personify\ChromaCam\Personify ChromaCam.exe" /StartFromInstaller
                                                                                            2⤵
                                                                                            • Modifies system certificate store
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1044
                                                                                            • C:\Program Files (x86)\Personify\ChromaCam\ChromaCam SystemTray.exe
                                                                                              "ChromaCam SystemTray.exe"
                                                                                              3⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:1496
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/o/oauth2/v2/auth?response_type=code&scope=openid%20email%20profile&redirect_uri=http%3A%2F%2F127.0.0.1%3A49964%2F&client_id=196722717059-kv17j9jjf73h5kqoshmdoe3hl0nbe5ae.apps.googleusercontent.com&state=J4tiJCNitIP7ui9iMRYCA-ncL5tSaO4rAnh4gdP41Gk&code_challenge=zkAPCHfRkSq_FfgrwR2izPO8EBL2Wf6NZh5Eg9N2Vu0&code_challenge_method=S256
                                                                                              3⤵
                                                                                              • Adds Run key to start application
                                                                                              • Enumerates system info in registry
                                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:2460
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc50946f8,0x7ffdc5094708,0x7ffdc5094718
                                                                                                4⤵
                                                                                                  PID:1492
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                                                                                                  4⤵
                                                                                                    PID:1676
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
                                                                                                    4⤵
                                                                                                      PID:560
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 /prefetch:8
                                                                                                      4⤵
                                                                                                        PID:4064
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:1376
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:4580
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5476 /prefetch:8
                                                                                                            4⤵
                                                                                                              PID:5080
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5620 /prefetch:8
                                                                                                              4⤵
                                                                                                                PID:5088
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
                                                                                                                4⤵
                                                                                                                  PID:1988
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                                                                  4⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:116
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b19f5460,0x7ff7b19f5470,0x7ff7b19f5480
                                                                                                                    5⤵
                                                                                                                      PID:3980
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16246708794632717597,10218839245147035873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
                                                                                                                    4⤵
                                                                                                                      PID:3100
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/o/oauth2/v2/auth?response_type=code&scope=openid%20email%20profile&redirect_uri=http%3A%2F%2F127.0.0.1%3A55943%2F&client_id=196722717059-kv17j9jjf73h5kqoshmdoe3hl0nbe5ae.apps.googleusercontent.com&state=7HHqg3mce-XjV2-AgfSPio2LKyFdZb34G9UvOYvEgCE&code_challenge=xbiRURfjRpS5B8wvKrrM6vDdjdtxt4SkaCh64SpDA0c&code_challenge_method=S256
                                                                                                                    3⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    PID:372
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc50946f8,0x7ffdc5094708,0x7ffdc5094718
                                                                                                                      4⤵
                                                                                                                        PID:2012
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                                                                                        4⤵
                                                                                                                          PID:4664
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
                                                                                                                          4⤵
                                                                                                                            PID:316
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3100 /prefetch:8
                                                                                                                            4⤵
                                                                                                                              PID:1824
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:1680
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:984
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4260 /prefetch:8
                                                                                                                                  4⤵
                                                                                                                                    PID:4824
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 /prefetch:8
                                                                                                                                    4⤵
                                                                                                                                      PID:4748
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
                                                                                                                                      4⤵
                                                                                                                                        PID:3416
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
                                                                                                                                        4⤵
                                                                                                                                          PID:4672
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5264 /prefetch:8
                                                                                                                                          4⤵
                                                                                                                                            PID:2208
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:8
                                                                                                                                            4⤵
                                                                                                                                              PID:1716
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:2060
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2901466656507041779,14447761938463401086,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:4296
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:564
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{724467AC-7A64-48E6-9AD6-0FCE5C04CF26}\MicrosoftEdge_X64_100.0.1185.39.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{724467AC-7A64-48E6-9AD6-0FCE5C04CF26}\MicrosoftEdge_X64_100.0.1185.39.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:3016
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{724467AC-7A64-48E6-9AD6-0FCE5C04CF26}\EDGEMITMP_DBD7E.tmp\setup.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{724467AC-7A64-48E6-9AD6-0FCE5C04CF26}\EDGEMITMP_DBD7E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{724467AC-7A64-48E6-9AD6-0FCE5C04CF26}\EDGEMITMP_DBD7E.tmp\MSEDGE.PACKED.7Z" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:1188
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNDUuNDkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNDUuNDkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTJGRjhEODctNEM0OC00MzNCLTlCNEUtMTg0Qzc3MEFDNEIwfSIgdXNlcmlkPSJ7QTA1OTU5NDAtREMwQy00MzY5LUIyNDItRkRENDE2QUYzQzE3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOEEwMzBFQy05N0UzLTRFNzQtQkQyNS1DOEI2NjEzNTNCQkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMDAuMC4xMTg1LjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmM4M2EwMGItMDUxYi00Nzk2LWI4YjMtMGZkOTlhZWFjNzgxP1AxPTE2NTA1Njk1OTMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9QXV5ZlFaM0tFMjBzN1RLa2kwZVV6eGZLUk1qeTBaTGhHV2thcUhQMCUyYjVYcnJXcGJtVVFET0ZCSmU4MEg5Q1VtSmp2aDlYcklTbEpUbnpKJTJmeVMxRnJnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBkb3dubG9hZGVkPSIxMTk3NzU2NjQiIHRvdGFsPSIxMTk3NzU2NjQiIGRvd25sb2FkX3RpbWVfbXM9IjkyNDQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQ4NCIgZG93bmxvYWRfdGltZV9tcz0iMTU5NjMiIGRvd25sb2FkZWQ9IjExOTc3NTY2NCIgdG90YWw9IjExOTc3NTY2NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjQ2MTAiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:4172
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4804
                                                                                                                                          • C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe
                                                                                                                                            "C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:5116
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                            1⤵
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2648
                                                                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                                                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0e975e94-551b-b648-9576-042e9852e5ae}\psycamera.inf" "9" "47893badf" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\personify\chromacam\64"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:4652
                                                                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                                                                              DrvInst.exe "2" "211" "ROOT\IMAGE\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:c14ce884f956a7e6:PsyCamera:8.35.56.591:psycamera," "47893badf" "0000000000000148"
                                                                                                                                              2⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Modifies registry class
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:1240
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                                                                            1⤵
                                                                                                                                              PID:932
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                                              1⤵
                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:2524
                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                                PID:4116
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                                                1⤵
                                                                                                                                                  PID:1360
                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2860

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\EdgeUpdate.dat
                                                                                                                                                    Filesize

                                                                                                                                                    12KB

                                                                                                                                                    MD5

                                                                                                                                                    369bbc37cff290adb8963dc5e518b9b8

                                                                                                                                                    SHA1

                                                                                                                                                    de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                                                                                                                                    SHA256

                                                                                                                                                    3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                                                                                                                                    SHA512

                                                                                                                                                    4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                                                                    Filesize

                                                                                                                                                    160KB

                                                                                                                                                    MD5

                                                                                                                                                    9caf47e9999af93d8f49c0f5b62ac693

                                                                                                                                                    SHA1

                                                                                                                                                    dd83435e30a88d2df849e4d4c8e3e671d545677a

                                                                                                                                                    SHA256

                                                                                                                                                    8ce4842eb307265d3a1a43bb558925030ec5c399bd8a67ac0e3b9a9b55e1a64d

                                                                                                                                                    SHA512

                                                                                                                                                    6aea29ec91f4e494917aa22331ae6cb62e4ebcf84b03abe562bad43993b5750388b35084cd179ef52c00799c88dad8cc658e31e3649cf866c228ccd5cb0118ea

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                                                    Filesize

                                                                                                                                                    209KB

                                                                                                                                                    MD5

                                                                                                                                                    d7d541bd3dd228ad24dadfc4089b0704

                                                                                                                                                    SHA1

                                                                                                                                                    3fe7399267cf9bce649922d8ea0be9a5ffa77f67

                                                                                                                                                    SHA256

                                                                                                                                                    cedade653a1e8d68809199c87a65a7a69fb360f67177262e651253cf0316b842

                                                                                                                                                    SHA512

                                                                                                                                                    aca02d3bc55b7301257c56232b899145ad3266c210997d9eae664a0c6b6796e646a93db012e0a1b0d446cd64c55f916ab6f9a822b7b6b5faabfb75e3b5e3f011

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                                                    Filesize

                                                                                                                                                    209KB

                                                                                                                                                    MD5

                                                                                                                                                    d7d541bd3dd228ad24dadfc4089b0704

                                                                                                                                                    SHA1

                                                                                                                                                    3fe7399267cf9bce649922d8ea0be9a5ffa77f67

                                                                                                                                                    SHA256

                                                                                                                                                    cedade653a1e8d68809199c87a65a7a69fb360f67177262e651253cf0316b842

                                                                                                                                                    SHA512

                                                                                                                                                    aca02d3bc55b7301257c56232b899145ad3266c210997d9eae664a0c6b6796e646a93db012e0a1b0d446cd64c55f916ab6f9a822b7b6b5faabfb75e3b5e3f011

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                                    Filesize

                                                                                                                                                    203KB

                                                                                                                                                    MD5

                                                                                                                                                    d51ad58ff2e702fcf54e5580c3d5195b

                                                                                                                                                    SHA1

                                                                                                                                                    cf65da922713ee8507fd7976ebf4786b83d194c4

                                                                                                                                                    SHA256

                                                                                                                                                    e14aa9b45f08b41fa555568396b38c3cef3827ce46c95ac1c34b34fb65cb20a9

                                                                                                                                                    SHA512

                                                                                                                                                    c9d40c6c22a9115162b34b24fe24f8da5c263b634067ace2822e6cc3206c01a546ed1df3dde09e31cdd86d0b175dddf696e9a5fea63987175c187428056f9e3d

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\MicrosoftEdgeUpdateCore.exe
                                                                                                                                                    Filesize

                                                                                                                                                    237KB

                                                                                                                                                    MD5

                                                                                                                                                    b6e0a6427151dfaeca0fc7d84b6e9523

                                                                                                                                                    SHA1

                                                                                                                                                    a03f31f6a8e0fc7f386993a8e8082c383b41a438

                                                                                                                                                    SHA256

                                                                                                                                                    f70cddb720fb4e482704693af2fb2cd862c8ca324a13cb009d8ed30c95184f23

                                                                                                                                                    SHA512

                                                                                                                                                    6a4c673c12a7b8970a6920b4d832fb42680f2b277a832f28f2c41d57821cf7e8a46f562ec6783b81b7eff71365af0f713230a454793396518578c5536d124c29

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\NOTICE.TXT
                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    6dd5bf0743f2366a0bdd37e302783bcd

                                                                                                                                                    SHA1

                                                                                                                                                    e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                                                                                                                                    SHA256

                                                                                                                                                    91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                                                                                                                                    SHA512

                                                                                                                                                    f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdate.dll
                                                                                                                                                    Filesize

                                                                                                                                                    2.5MB

                                                                                                                                                    MD5

                                                                                                                                                    0c9199555050145619d3adb0b9c86d90

                                                                                                                                                    SHA1

                                                                                                                                                    e290a258869bb45a52c3cec13cfe042c6cd411f7

                                                                                                                                                    SHA256

                                                                                                                                                    eaca58832f1c5d40db402d8165997893be10c42f86b372ab253c66cdacef1cf7

                                                                                                                                                    SHA512

                                                                                                                                                    ca71932635875224d1cf439294065db925d1c46609b529b589e1ee874f24f2a838a366fc083e42444f8e1ff0eba6ae0c8db6e43ced9eb6c15897d2308d8b2bd1

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdate.dll
                                                                                                                                                    Filesize

                                                                                                                                                    2.5MB

                                                                                                                                                    MD5

                                                                                                                                                    0c9199555050145619d3adb0b9c86d90

                                                                                                                                                    SHA1

                                                                                                                                                    e290a258869bb45a52c3cec13cfe042c6cd411f7

                                                                                                                                                    SHA256

                                                                                                                                                    eaca58832f1c5d40db402d8165997893be10c42f86b372ab253c66cdacef1cf7

                                                                                                                                                    SHA512

                                                                                                                                                    ca71932635875224d1cf439294065db925d1c46609b529b589e1ee874f24f2a838a366fc083e42444f8e1ff0eba6ae0c8db6e43ced9eb6c15897d2308d8b2bd1

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_af.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    bbcba04b4368221736141f6da3dcc259

                                                                                                                                                    SHA1

                                                                                                                                                    54e0d0761995fadcb9d588a079fa1e4b472a968d

                                                                                                                                                    SHA256

                                                                                                                                                    988be2b023768090eae11fddff079e31512edb975920f97c1a3e9bc8c42c0064

                                                                                                                                                    SHA512

                                                                                                                                                    fa00c567de74a56223af838a89e6efc036de786c3e5513ad32d358693d3931873179007aa54b99f7be54ef5df8584f4fa7bc75dc13f2fdc92b4bedf36a7ef4dd

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_am.dll
                                                                                                                                                    Filesize

                                                                                                                                                    23KB

                                                                                                                                                    MD5

                                                                                                                                                    c2684f7568e44d9adb284f39e658af48

                                                                                                                                                    SHA1

                                                                                                                                                    f15d1381d2b6cbe8b28d7778236f2e1f7cd5b93e

                                                                                                                                                    SHA256

                                                                                                                                                    5cc5a2b40b4aa078dec600da52c2fd06b1c14ffb780fe7e928f815001aea1467

                                                                                                                                                    SHA512

                                                                                                                                                    79056a8995daca7de8664a67fb557c8f2cf5c460501d149b0dfcde3e9b81f3fcd903c832c4406ac63fe82436cfa8d83e34eb1681cdd1da04d70314791bfb6d50

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_ar.dll
                                                                                                                                                    Filesize

                                                                                                                                                    25KB

                                                                                                                                                    MD5

                                                                                                                                                    529a2715fb172ed53f691d7e9f162965

                                                                                                                                                    SHA1

                                                                                                                                                    287ac0ef438bbfa46b6968cb9b49405ecbc17b65

                                                                                                                                                    SHA256

                                                                                                                                                    db8e1c2616674f557cf12d12a72e69b270af942e507c6ec57b38b5945120a364

                                                                                                                                                    SHA512

                                                                                                                                                    d3a62e277b0872c1371f5459f2ca35293ce6db27997462c7c7b70337cf9a08cd528d9063e4daa7124a32c47f8f68c10fae8eef8a6311872757b3b84f4c04b0b2

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_as.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    149dde1066fc706cad0e940a43712b8a

                                                                                                                                                    SHA1

                                                                                                                                                    05ece216582c89c53ddac41e0a45c3aa021d9a3f

                                                                                                                                                    SHA256

                                                                                                                                                    536ac447c4716c40a44eb4d41b38da584d449e402ae2c009968bd276221d7bee

                                                                                                                                                    SHA512

                                                                                                                                                    950f1023ac42855ece0fbd9816e6b64fb2df6e532278c59ee96594692de97cd6af069a57006ad9aad3bb2cbeb83ca95c13ae018e7692356ed622c851f648e089

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_az.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    2d81bba9b5ac6c450186db93b761896e

                                                                                                                                                    SHA1

                                                                                                                                                    69669f5cb136ffc4bc783947027d5a620595eb45

                                                                                                                                                    SHA256

                                                                                                                                                    768ba9c4c0e7e044f659b44e2e95f60b14ccd9a4898e2b5a7e60cc16a8595c36

                                                                                                                                                    SHA512

                                                                                                                                                    774433c8c8bf2eff50218810180b4cf97fa67a9ac2cdf8215b16b0772039f14df541d9d9388db8176b98feec26ed7086be9eb2dc1eb6bcba350bd670e4767bba

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_bg.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    d8f16d00982003aa07fd3016115576a7

                                                                                                                                                    SHA1

                                                                                                                                                    06a939ddbde4dc07285998433e707de1766c1ea9

                                                                                                                                                    SHA256

                                                                                                                                                    013dd144e2e2bcf0d251e2a7868ae14f270258fea9d824cbe68ab45358796c6b

                                                                                                                                                    SHA512

                                                                                                                                                    4db7aba83be3b847a103a6fe2a33e3daa94f487bdc081b5bddb2cbd8bef9e65ca60758e56be43281669df8d64a2218feb70271f41fa8c98d1be2315f6290f5e6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_bn-IN.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    f2de31f06d14f1c3558841aa3d93151a

                                                                                                                                                    SHA1

                                                                                                                                                    b9e855ac33d253f3dbfb0eecb014b5aaaeb7a60c

                                                                                                                                                    SHA256

                                                                                                                                                    46b55cc5c0f5fce1a7ef57fe34494ce747a306b5e1e553c1938823c0c3051f7f

                                                                                                                                                    SHA512

                                                                                                                                                    a9b941fec9faf702b6c156a03c58137f8a6517ece1d8ef710a11ce45a278f6435651c0c24c803b47acbc0a80f043e6f7edbabc34be5177d656b1003508e488c3

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_bn.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    ce30eba6f600030af2efcb27ed5ad47e

                                                                                                                                                    SHA1

                                                                                                                                                    2a40a1dc547295f647426bd4cf374559dd4354b7

                                                                                                                                                    SHA256

                                                                                                                                                    1483b44c5c7f9d6ad0918d0c0a8aae1b85f50825f919d2b26ef135adfc8a1be7

                                                                                                                                                    SHA512

                                                                                                                                                    e4c1c6c6e8fac0be5180d54514f17a73eee78d0ddfbe600ad0e02817f7fc768759f75f12dadb1589e8840d967a26e40d97b09b223665feaaab81391cbeb2bff8

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_bs.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    ef48ddaab5f139aafd2b35f203231301

                                                                                                                                                    SHA1

                                                                                                                                                    d7d219608c9f439cdfb418da02df5ad5a4293a7d

                                                                                                                                                    SHA256

                                                                                                                                                    1fdb779f5a2c94f7df2de51fc5135fe124cb019670b4b703c30b9b36ee42c3be

                                                                                                                                                    SHA512

                                                                                                                                                    5d0e02d23bb31b490ee6812462817967405f7d0c6e7582bab648377dfc4f439410ed7e18f1c5dc3192e676be92554ebde4ee415c334f8051586131909b71f69e

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    3ca0f0a8008fe7cffa6cc93d92046f1d

                                                                                                                                                    SHA1

                                                                                                                                                    e37924cd9fda5c366ede61e12c491636e05f3377

                                                                                                                                                    SHA256

                                                                                                                                                    1388ee7b0605fa5cba0fb433ac6f3d24aee1f7ddb9692e36ba60a9206fbe63f0

                                                                                                                                                    SHA512

                                                                                                                                                    d89fce1537c428811326efaba2afcf9f2597944465335527c0ad097bbd71e652d4f96d1dbab3e5b1cdc493595d613730fe29a41822f05338a9b04a66bdc2a37f

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_ca.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    3dad7ac66afa4f629aa35aacbdb49a91

                                                                                                                                                    SHA1

                                                                                                                                                    d8ce59f298d5b2b10653e68839fa3c556fe18cdd

                                                                                                                                                    SHA256

                                                                                                                                                    7194606a0cc8cb328d47b05ceb5a518478224f1c95296ec3cbb711d8150dadb1

                                                                                                                                                    SHA512

                                                                                                                                                    a0a6303f58058a6a3d9938c515f2c164bef5d00bd3fde4f2bceb19c82de8388fa14e8176e5ac1969f26422502c300a1a3d9993c182817da107ecf979301b7e0e

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_cs.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    d31a2d3689673bb841f9d2184436b316

                                                                                                                                                    SHA1

                                                                                                                                                    2c9db8bd9918b077e4dcb6291f2c3f36100336db

                                                                                                                                                    SHA256

                                                                                                                                                    518035972c761a8eb2aeba515bb00179b2b5bd2e295e4676d32c5e00c086b660

                                                                                                                                                    SHA512

                                                                                                                                                    93e59283bbf0c9739602ea79e96456b09d785816c6385a547ac52a89a7396aa7ebf30b9d579764084105d054e9bcf7e111124e1a42a5eb24508f2afee5adacf6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_cy.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    a47c42123b2804b0af0c54467a4260ee

                                                                                                                                                    SHA1

                                                                                                                                                    225cd3d53185737de9294820ba7e500215f1b250

                                                                                                                                                    SHA256

                                                                                                                                                    337047b096d243f132bcc480b1fc3266729de6e1d5fd7ce0d55006c9f25aa904

                                                                                                                                                    SHA512

                                                                                                                                                    1458e39db032d03256bd91bcb20d1495656e75eb05aa24d5fc976834e49a1ef3c748296d141baeda1e3c44d117d5f729c9eaac5285244d919eb41626cc23fb76

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_da.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    9db6506250f98abf32cf3263636552b3

                                                                                                                                                    SHA1

                                                                                                                                                    b1f063cc03054fa2d7a32c5a103bbc38e69e7fa6

                                                                                                                                                    SHA256

                                                                                                                                                    b45a10453fc7fac054e70f9dfa83030b7828034a3e5102d3e71f0e6279e1aeeb

                                                                                                                                                    SHA512

                                                                                                                                                    bea11ffb729b55d9e191ca4b32dadf68a37f8135f59bb214c122ebaffa935000c535b092c6ba2bf6b968fe53e7bc99a30a7c97eedd13edc0898ae76f1d185e3a

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_de.dll
                                                                                                                                                    Filesize

                                                                                                                                                    29KB

                                                                                                                                                    MD5

                                                                                                                                                    d3dec2f4af4eb79dabb174bf5532741a

                                                                                                                                                    SHA1

                                                                                                                                                    2f29f52498022fc82dc31da05f1029cc24134fa0

                                                                                                                                                    SHA256

                                                                                                                                                    07eb6ee73be32957a3e0e53dec0c6230f1df7862827e0b7b4d5250f43880211c

                                                                                                                                                    SHA512

                                                                                                                                                    bff2ea0507670aad62a619188f923cb58b76ab685284d97a753b7b8997da1c62908af0a57149ce57575800fa3764239fc9fef42b22f2aa67acadcf4b8c9fd946

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_el.dll
                                                                                                                                                    Filesize

                                                                                                                                                    29KB

                                                                                                                                                    MD5

                                                                                                                                                    567558de3be01745173565e5a304b8fd

                                                                                                                                                    SHA1

                                                                                                                                                    cd5f663fbc5ad54f61a158ee5a4d2969bddec5aa

                                                                                                                                                    SHA256

                                                                                                                                                    8f50d7401b44b5089465c34db4baf475f300be9683657ec6cbdbc87b9a5cdfe4

                                                                                                                                                    SHA512

                                                                                                                                                    7348486abf0a5c7db19406f14f21eba5c75a68b1c0fe0c7414aa3e23ad875895bcc9055c17a08226286353aee4c67d2d8d483e893f274dd9a69cc4803232a05c

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_en-GB.dll
                                                                                                                                                    Filesize

                                                                                                                                                    26KB

                                                                                                                                                    MD5

                                                                                                                                                    46d4c79c666755374b2c23e43f1dfa4d

                                                                                                                                                    SHA1

                                                                                                                                                    aa92ac32702bbc46dd4e5b4581eaa9c0d1d6c674

                                                                                                                                                    SHA256

                                                                                                                                                    f137dbcb877c55e3173dc288a717847d4bc6fefde47f2850984cedd34b770837

                                                                                                                                                    SHA512

                                                                                                                                                    d9a3da990bb09c96f5873723b39256fcff18919918361fdd7f34714b063f1e45d5d19d3daa3ec90ce1c4b2766742ecb5c4eebbc664fc68dc2524c1746aa2eaa4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_en.dll
                                                                                                                                                    Filesize

                                                                                                                                                    26KB

                                                                                                                                                    MD5

                                                                                                                                                    cb78d1e912542bc2299cece8348c9f52

                                                                                                                                                    SHA1

                                                                                                                                                    70f35b8fc2ee00e8f47b67e8b3b8cc018cd4e29d

                                                                                                                                                    SHA256

                                                                                                                                                    9b432eb71b7b94dbe7e9890ad112f1570a74221eb766d5b40c105daa03697b8c

                                                                                                                                                    SHA512

                                                                                                                                                    fb58db15d3a258a85a3e93a8cc752ccc3d42655f9ab7d9730afa1ac2a301555f37f5a15daf10933d32b2c8e566acafa2a267ffc7103814e7fe924733c54ce9d6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_es-419.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    ff961e92feefa84c388aeca7cdee9031

                                                                                                                                                    SHA1

                                                                                                                                                    0850fe7d29e29072fafce0ddfb0356fa568650f7

                                                                                                                                                    SHA256

                                                                                                                                                    5f1f0d19b65dd369cbab64809a7c45715176a7333ea021d3e5d9fafe92bc2bb4

                                                                                                                                                    SHA512

                                                                                                                                                    e81be328f4e9ad4e47c134ee448b4874f0d5e81a927150bcf4637e1eca2d20ca068b36fc1e97a294e73102ab5e4512d19fd2576e159859b4c4848a912c752947

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_es.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    a12ad07d08b8e5f1fbeb91fb23653d09

                                                                                                                                                    SHA1

                                                                                                                                                    2ad01ba02c6c4753a12cad3148192b3b1102bfa8

                                                                                                                                                    SHA256

                                                                                                                                                    b133e5dcd50a0f8ad87ea6274d873d5fd6c1c8020867e0e3423aea5f737a77b5

                                                                                                                                                    SHA512

                                                                                                                                                    0419d5391cf5b282ff98eade9a1a45a2203c1902f6abbaaffb4c417dc9a747d8827cd214d9c5e2a35ccae55cdf49466ee5978fc38fea79bf2a7945b749101042

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_et.dll
                                                                                                                                                    Filesize

                                                                                                                                                    26KB

                                                                                                                                                    MD5

                                                                                                                                                    143da718ea39b1a2a42962e6a2bd3970

                                                                                                                                                    SHA1

                                                                                                                                                    cd67424ebf47d658a14c5a66ea3ae83b1417de3a

                                                                                                                                                    SHA256

                                                                                                                                                    fdb4f9619dbc4da195bae06005d63d28d322a736922b2732bf147b3f8f4090c9

                                                                                                                                                    SHA512

                                                                                                                                                    df55fc3f311bc990e353159a63eb143514d21cf4563a51a962d2a277338697d10f76549abd0f7ac788f3b1776a5afc76d5a29150f50f49ea665e92427f32111c

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_eu.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    3a2c967dfd4abd218b4372eb947b1be8

                                                                                                                                                    SHA1

                                                                                                                                                    15ec1ee1855a97acb2ceb1861822ba975b5ac1ad

                                                                                                                                                    SHA256

                                                                                                                                                    186c3759bb19281652fd8aec7d6d880be76957bf3643511912e268f08f0b7ba7

                                                                                                                                                    SHA512

                                                                                                                                                    f6292aaa9cf2a03e751494bb1b71e6db4e10ac4bea975f274d53dbcd2091e546916c3f7af6d2b5a0de80da432e69f360d99020ac8a72f7d1c9a7f267fe8d4645

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_fa.dll
                                                                                                                                                    Filesize

                                                                                                                                                    26KB

                                                                                                                                                    MD5

                                                                                                                                                    b7c02449605cf2f23827e1563093900a

                                                                                                                                                    SHA1

                                                                                                                                                    a774a4363f91cdaa3fc00c3f3f7f159366f65348

                                                                                                                                                    SHA256

                                                                                                                                                    c59a30a2a711c5a2b0590e89f710a7e9e56e7676ac4e172b76a459a53e938557

                                                                                                                                                    SHA512

                                                                                                                                                    88118e2f4b59e3f95f7c92d3a318c97e207ece6ec4ef0ce0c3186b5815dd1b5e8042b8f9c0b22509b9d3e95b4bf9686a16d250b7a81cc8bd447fc8e5b56b2661

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_fi.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    f0ea857b6defcc66a48b080ed6deee02

                                                                                                                                                    SHA1

                                                                                                                                                    68d38516383169a7de9916f636767620a65eacbb

                                                                                                                                                    SHA256

                                                                                                                                                    4c2466de5cd11570e9cecc8146b644f8031cf8a438b6474cd2991ef187823fa7

                                                                                                                                                    SHA512

                                                                                                                                                    542b658d851319f1fd529516ff32c2b48bdf0ae4d6facc6de43a9ca6c91f4af696d76318ea8e9ae9e691e60853abd250374f125c71a61d50d4b4fdaf67446647

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_fil.dll
                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    MD5

                                                                                                                                                    d798c5860e5822a57bef5a574343c1fe

                                                                                                                                                    SHA1

                                                                                                                                                    774940f0d229e5a08e56a109baf464d4e98affa5

                                                                                                                                                    SHA256

                                                                                                                                                    1e1445d34d1dc39c6f225416d4d794b272207ea712ef938796280b23bf3c326b

                                                                                                                                                    SHA512

                                                                                                                                                    6aef37604473dbf0909fd509da7a290b45fb8a90addb0bdc8a479c92720d0f7affa042d2d793601a224534a58a62dc98f499cb5bfabc10152883243443e9f2f6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_fr-CA.dll
                                                                                                                                                    Filesize

                                                                                                                                                    29KB

                                                                                                                                                    MD5

                                                                                                                                                    d9728e7bc603e9d78dfced409bbb397a

                                                                                                                                                    SHA1

                                                                                                                                                    5748b6d97bd291ccef5849c2493837cb50469c4b

                                                                                                                                                    SHA256

                                                                                                                                                    002411816d867e54f11dd3ecd4b3be50980d2d2da624ce8b09746938e96999b6

                                                                                                                                                    SHA512

                                                                                                                                                    e3494e992f11768157cda1fe431debfb7ea7bf2b1d7bb164b7bd7cf7fe809f55acfb61bf7bfbdd7ea8e0f78a7a55dc891dab4023d98884b924191e76e8bfa88a

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_fr.dll
                                                                                                                                                    Filesize

                                                                                                                                                    29KB

                                                                                                                                                    MD5

                                                                                                                                                    9c7e3ad929d07a70a337d209c4de2f9e

                                                                                                                                                    SHA1

                                                                                                                                                    5834bd8fe9bfde2446872435227d29922a8c1fbc

                                                                                                                                                    SHA256

                                                                                                                                                    a26b9202d4ae3d01b2f621850cd27fa92d4364a49115e1f53af42db60f839d1b

                                                                                                                                                    SHA512

                                                                                                                                                    dc5a7248aa282638d06c177de100efbf73cbb54a8dd2870eea6b7a339ce78de6ee694ee4eb6ba6312e812d13fb99acb9c4ffa71f9424e17e15dbe8872605bdea

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_ga.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    f63747c12363c4cec898502cc203668d

                                                                                                                                                    SHA1

                                                                                                                                                    1c753c3d88fcb4df860ee7d00cb065ba7bf7717d

                                                                                                                                                    SHA256

                                                                                                                                                    b66ce918ba14955e5b3e0811a9f119ce4127d7ab2904290f603eedbdeaa02516

                                                                                                                                                    SHA512

                                                                                                                                                    b307e115ca7df16c14b099e7cb6cbd60c1d6279a0808c6c3549e685c7e4392197e7046d0f30ea30dc9d0d547a4d98be1a876b5f1341b061de9da5e936f062eb5

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_gd.dll
                                                                                                                                                    Filesize

                                                                                                                                                    29KB

                                                                                                                                                    MD5

                                                                                                                                                    d9fb2c2eec6753829ecd696368a7188d

                                                                                                                                                    SHA1

                                                                                                                                                    478da0c9ea9f195ca9e97775ea64932c535921b2

                                                                                                                                                    SHA256

                                                                                                                                                    1d2c6c21dc3d0e035b6a52488643915443a59be6b59f8e9980fe141497f2b88e

                                                                                                                                                    SHA512

                                                                                                                                                    9a3de0f81ad4bab68817f6625c21e01bee4d1a15fbc5aa291e71f939809f3a5ec4354f72ae0bcb9ae2cb0ace3f7bbcc62afed4de94781122502d8f14958c17d3

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_gl.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    fd74ef8e7df2dd9633fc38c9049b387b

                                                                                                                                                    SHA1

                                                                                                                                                    821db2f7eed3281bff0f667860ec15a895c25a7b

                                                                                                                                                    SHA256

                                                                                                                                                    800ffe4b034a831cbcfa2f1bdfbf041bcde7d6634ac0b35d27134698bb933093

                                                                                                                                                    SHA512

                                                                                                                                                    548ad532c1d9ae007e35d68e5a689c8121d7006feb5bfa63c591dcbba39c66cbc056936556716b69a05b06665bf069894dd76594d53a60e273522bd1572da52a

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_gu.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    dfec9cb117ca9af2eef58d007fbc5e88

                                                                                                                                                    SHA1

                                                                                                                                                    34acdb96b4b866f4302d83b3bbe7306dffb7ed49

                                                                                                                                                    SHA256

                                                                                                                                                    a5ed7005ba7e2a80086b541beb6ecba804b535d64c52569f4c1584398c9dd4d9

                                                                                                                                                    SHA512

                                                                                                                                                    a3874401162f824b2cb9e5140c24fcda1e6262b9711f8ec6b18f70483de8681f411bfe3e39ee2010ef2819874efd253fb9e99f3511127ff5ca3d8f2c5ebeb283

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Temp\EU74AE.tmp\msedgeupdateres_hi.dll
                                                                                                                                                    Filesize

                                                                                                                                                    27KB

                                                                                                                                                    MD5

                                                                                                                                                    30954c1e44fac7823ea1398731708d1a

                                                                                                                                                    SHA1

                                                                                                                                                    0c28f075d1a217fb85ea3979cfdc3cb98e819e9d

                                                                                                                                                    SHA256

                                                                                                                                                    3bb9535e16c08dc3f26900e9e7265e57db4f1c1d770b633d4453ee8d914dfc43

                                                                                                                                                    SHA512

                                                                                                                                                    98cf06e5c6224ea32bd91e7c93d8ad95cdbb187269caa5baed1b25626122ae1ee6c5a42aabd23a93bf5b01a678ed247d7f161d6f66b4d84dee5bdbc6089f9ebb

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\CpuGenDetection.exe
                                                                                                                                                    Filesize

                                                                                                                                                    51KB

                                                                                                                                                    MD5

                                                                                                                                                    3ecc570dc4915744492119c7898f8313

                                                                                                                                                    SHA1

                                                                                                                                                    d63fcc939f4135c7e18043691f44f28811a1aacb

                                                                                                                                                    SHA256

                                                                                                                                                    9381e2256a570d09df531241ec1e7fa8844153900a7e5f924c899f5bdd16b272

                                                                                                                                                    SHA512

                                                                                                                                                    f15ab619a95b421c0b6dbde68404d43461d40cd3515409865fd43012083e53f1ff7451cccd76c034f669b0320a33369fd588191094d031b9ef7cc6adc5921bb6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\CpuGenDetection.exe
                                                                                                                                                    Filesize

                                                                                                                                                    51KB

                                                                                                                                                    MD5

                                                                                                                                                    3ecc570dc4915744492119c7898f8313

                                                                                                                                                    SHA1

                                                                                                                                                    d63fcc939f4135c7e18043691f44f28811a1aacb

                                                                                                                                                    SHA256

                                                                                                                                                    9381e2256a570d09df531241ec1e7fa8844153900a7e5f924c899f5bdd16b272

                                                                                                                                                    SHA512

                                                                                                                                                    f15ab619a95b421c0b6dbde68404d43461d40cd3515409865fd43012083e53f1ff7451cccd76c034f669b0320a33369fd588191094d031b9ef7cc6adc5921bb6

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                                                                                                                                    Filesize

                                                                                                                                                    1.7MB

                                                                                                                                                    MD5

                                                                                                                                                    6abf61dd5a6318d76a11ce43b4bee001

                                                                                                                                                    SHA1

                                                                                                                                                    546fac452bb8892bed42b79b17dc0c86ca5ae7dc

                                                                                                                                                    SHA256

                                                                                                                                                    389601cbd7e9256ce22348e3ceb2c33e39ddc7a8c75db897d269dc23b17ad11d

                                                                                                                                                    SHA512

                                                                                                                                                    e454b2bb8ee2bf1355613afdf8389076fae5ffb8305ca2748cb05b597b54f039647e9aced03946dd6c0057305de80ca69db09cb2e539c6645fb2da6abf12ea7b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                                                                                                                                    Filesize

                                                                                                                                                    1.7MB

                                                                                                                                                    MD5

                                                                                                                                                    6abf61dd5a6318d76a11ce43b4bee001

                                                                                                                                                    SHA1

                                                                                                                                                    546fac452bb8892bed42b79b17dc0c86ca5ae7dc

                                                                                                                                                    SHA256

                                                                                                                                                    389601cbd7e9256ce22348e3ceb2c33e39ddc7a8c75db897d269dc23b17ad11d

                                                                                                                                                    SHA512

                                                                                                                                                    e454b2bb8ee2bf1355613afdf8389076fae5ffb8305ca2748cb05b597b54f039647e9aced03946dd6c0057305de80ca69db09cb2e539c6645fb2da6abf12ea7b

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\System.dll
                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    c17103ae9072a06da581dec998343fc1

                                                                                                                                                    SHA1

                                                                                                                                                    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                                                                                                                                                    SHA256

                                                                                                                                                    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                                                                                                                                                    SHA512

                                                                                                                                                    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\System.dll
                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    c17103ae9072a06da581dec998343fc1

                                                                                                                                                    SHA1

                                                                                                                                                    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                                                                                                                                                    SHA256

                                                                                                                                                    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                                                                                                                                                    SHA512

                                                                                                                                                    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\UAC.dll
                                                                                                                                                    Filesize

                                                                                                                                                    14KB

                                                                                                                                                    MD5

                                                                                                                                                    4814167aa1c7ec892e84907094646faa

                                                                                                                                                    SHA1

                                                                                                                                                    a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee

                                                                                                                                                    SHA256

                                                                                                                                                    32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822

                                                                                                                                                    SHA512

                                                                                                                                                    fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsDialogs.dll
                                                                                                                                                    Filesize

                                                                                                                                                    9KB

                                                                                                                                                    MD5

                                                                                                                                                    c10e04dd4ad4277d5adc951bb331c777

                                                                                                                                                    SHA1

                                                                                                                                                    b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

                                                                                                                                                    SHA256

                                                                                                                                                    e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

                                                                                                                                                    SHA512

                                                                                                                                                    853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsDialogs.dll
                                                                                                                                                    Filesize

                                                                                                                                                    9KB

                                                                                                                                                    MD5

                                                                                                                                                    c10e04dd4ad4277d5adc951bb331c777

                                                                                                                                                    SHA1

                                                                                                                                                    b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

                                                                                                                                                    SHA256

                                                                                                                                                    e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

                                                                                                                                                    SHA512

                                                                                                                                                    853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsExec.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6KB

                                                                                                                                                    MD5

                                                                                                                                                    acc2b699edfea5bf5aae45aba3a41e96

                                                                                                                                                    SHA1

                                                                                                                                                    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

                                                                                                                                                    SHA256

                                                                                                                                                    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

                                                                                                                                                    SHA512

                                                                                                                                                    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsExec.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6KB

                                                                                                                                                    MD5

                                                                                                                                                    acc2b699edfea5bf5aae45aba3a41e96

                                                                                                                                                    SHA1

                                                                                                                                                    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

                                                                                                                                                    SHA256

                                                                                                                                                    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

                                                                                                                                                    SHA512

                                                                                                                                                    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc81F7.tmp\nsislog.dll
                                                                                                                                                    Filesize

                                                                                                                                                    42KB

                                                                                                                                                    MD5

                                                                                                                                                    e47100b70748fc790ffe6299cdf7ef2d

                                                                                                                                                    SHA1

                                                                                                                                                    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

                                                                                                                                                    SHA256

                                                                                                                                                    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

                                                                                                                                                    SHA512

                                                                                                                                                    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

                                                                                                                                                    Download Submit

                                                                                                                                                  • memory/1044-332-0x0000000008B40000-0x0000000008B78000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    224KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-334-0x0000000008B30000-0x0000000008B38000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-339-0x0000000012E80000-0x00000000133AC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.2MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-338-0x0000000003500000-0x0000000003508000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-337-0x0000000009A70000-0x0000000009B16000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    664KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-336-0x0000000008BE0000-0x0000000008BEE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-335-0x0000000008C00000-0x0000000008C3A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    232KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-329-0x00000000073F0000-0x0000000007400000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-317-0x0000000000E30000-0x0000000001290000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4.4MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-318-0x0000000005A20000-0x0000000005A34000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    80KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-319-0x0000000005F50000-0x0000000006068000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-330-0x0000000008AE0000-0x0000000008AFC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    112KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-320-0x0000000006160000-0x000000000618E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    184KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-321-0x0000000006770000-0x0000000006878000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.0MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-333-0x0000000008830000-0x000000000883E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-323-0x0000000006660000-0x000000000666A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-324-0x0000000006680000-0x000000000668E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-331-0x0000000008820000-0x0000000008828000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-326-0x0000000007510000-0x000000000819A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    12.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-327-0x0000000005E30000-0x0000000005F48000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-142-0x0000000002C01000-0x0000000002C03000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-218-0x00000000005B0000-0x00000000005C0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-133-0x0000000002B41000-0x0000000002B43000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-145-0x0000000000590000-0x00000000005A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-316-0x0000000004D50000-0x0000000004D60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1184-136-0x0000000002B50000-0x0000000002B60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1496-325-0x0000000004B40000-0x0000000004BD2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    584KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1496-328-0x0000000005040000-0x000000000504A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1496-322-0x0000000000220000-0x0000000000254000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    208KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-300-0x0000000007840000-0x00000000078D6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    600KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-298-0x0000000006750000-0x000000000676E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-293-0x0000000002E20000-0x0000000002E56000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-294-0x0000000005A60000-0x0000000006088000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-295-0x0000000005670000-0x0000000005692000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-296-0x0000000006090000-0x00000000060F6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-297-0x0000000006100000-0x0000000006166000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-299-0x0000000005425000-0x0000000005427000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-301-0x0000000006C70000-0x0000000006C8A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    104KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-302-0x0000000006D30000-0x0000000006D52000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-303-0x0000000007E90000-0x0000000008434000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1560-304-0x0000000008AC0000-0x000000000913A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1676-341-0x00007FFDE3200000-0x00007FFDE3201000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3388-265-0x0000000000AB0000-0x0000000000B14000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    400KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3388-266-0x0000000000AB1000-0x0000000000B08000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    348KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4296-285-0x0000000000730000-0x0000000000799000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    420KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4296-286-0x0000000000731000-0x000000000078C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    364KB

                                                                                                                                                    Download