b05578f3b64cbd41a9aab28171d404f2c0463c7850abb1d8df43c43d1e8ed710

Analysis

max time kernel
494s
max time network
539s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03/06/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TopazGigapixelAI-7.2.0.msi
Size

254.3MB
MD5

30dc3c668473463b569f0111fcb37c9d
SHA1

e993348efd304d5d4f374ddf15ae886566b6135b
SHA256

b05578f3b64cbd41a9aab28171d404f2c0463c7850abb1d8df43c43d1e8ed710
SHA512

11af4fd65ad10ef107ba5ce545a56f1f1ba5550eec8e1c606e9e4cdd1519a53369e2b80da5366c2dced227d4273b375d2275e6d5a4a63c03b4e8e11a71905396
SSDEEP

6291456:oGjWPgfIOsUe2OXGMXrkGq6PiVd1DIW0T5t1pmQ77PAnIx1Py:3qUle2OW35d1Dw1anIP

Score

8^/10

bootkit persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	4112	msiexec.exe
5	4112	msiexec.exe
636	6064	powershell.exe
638	6064	powershell.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
109	camo.githubusercontent.com
563	discord.com
637	bitbucket.org
638	bitbucket.org
104	camo.githubusercontent.com
110	camo.githubusercontent.com
111	camo.githubusercontent.com
112	camo.githubusercontent.com
480	raw.githubusercontent.com
564	discord.com
703	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\baseutils.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\TBaseUtils\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\benchmark.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\TBenchmark\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\cameraprofile.dll	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1F36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI308E.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\Installer\e591042.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591042.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A073B92-9B07-4954-B063-33112D07C8F3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3748.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31D7.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File opened for modification	C:\Windows\Installer\MSI20CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3236.tmp	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
5476	dismhost.exe
4396	MEMZ.exe
5320	MEMZ.exe
6028	MEMZ.exe
5700	MEMZ.exe
5084	MEMZ.exe
3192	MEMZ.exe
5984	MEMZ.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4448	sc.exe
4280	sc.exe
5516	sc.exe
5644	sc.exe
5440	sc.exe
5680	sc.exe
5280	sc.exe
5780	sc.exe
5296	sc.exe
3980	sc.exe
1964	sc.exe
2904	sc.exe
5184	sc.exe
5884	sc.exe
4780	sc.exe
4180	sc.exe
5464	sc.exe
4852	sc.exe
4248	sc.exe
5184	sc.exe
4352	sc.exe
5124	sc.exe
5516	sc.exe
5864	sc.exe
1844	sc.exe
3632	sc.exe
3436	sc.exe
2244	sc.exe
4480	sc.exe
704	sc.exe
6016	sc.exe
5192	sc.exe
5524	sc.exe
6116	sc.exe
3160	sc.exe
2004	sc.exe
3656	sc.exe
4364	sc.exe
5100	sc.exe
6048	sc.exe
5900	sc.exe
5772	sc.exe
5128	sc.exe
2276	sc.exe
5964	sc.exe
5520	sc.exe
4984	sc.exe
1048	sc.exe
5852	sc.exe
3896	sc.exe
2012	sc.exe
4688	sc.exe
5692	sc.exe
4248	sc.exe
4172	sc.exe
4340	sc.exe
5740	sc.exe
4248	sc.exe
2092	sc.exe
4480	sc.exe
6080	sc.exe
4000	sc.exe
5400	sc.exe
312	sc.exe

Loads dropped DLL 26 IoCs

pid	Process
3708	MsiExec.exe
3708	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
1528	MsiExec.exe
1528	MsiExec.exe
1528	MsiExec.exe
4864	MsiExec.exe
1528	MsiExec.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe
5476	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
204	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618699810686458"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5984	reg.exe
3056	reg.exe
5252	reg.exe
4588	reg.exe
1852	reg.exe
5328	reg.exe
5168	reg.exe
5784	reg.exe
668	reg.exe
5384	reg.exe
5876	reg.exe
4964	reg.exe
364	reg.exe
220	reg.exe
5220	reg.exe
4828	reg.exe
5588	reg.exe
4320	reg.exe
1612	reg.exe
3200	reg.exe
1964	reg.exe
5372	reg.exe
5204	reg.exe
2744	reg.exe
2228	reg.exe
2328	reg.exe
520	reg.exe
6116	reg.exe
5932	reg.exe
2944	reg.exe
3060	reg.exe
4352	reg.exe
2968	reg.exe
5140	reg.exe
5932	reg.exe
4552	reg.exe
5156	reg.exe
5456	reg.exe
4488	reg.exe
1908	reg.exe
5544	reg.exe
200	reg.exe
5356	reg.exe
1300	reg.exe
5436	reg.exe
2876	reg.exe
2132	reg.exe
5776	reg.exe
428	reg.exe
412	reg.exe
4440	reg.exe
2072	reg.exe
5340	reg.exe
1060	reg.exe
5860	reg.exe
3548	reg.exe
5148	reg.exe
5212	reg.exe
5172	reg.exe
3924	reg.exe
5236	reg.exe
2968	reg.exe
5080	reg.exe
5908	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5572	PING.EXE
6036	PING.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4704	vlc.exe
4332	WINWORD.EXE
4332	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
2160	msiexec.exe
2160	msiexec.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
4864	MsiExec.exe
2160	msiexec.exe
2160	msiexec.exe
4288	chrome.exe
4288	chrome.exe
4248	chrome.exe
4248	chrome.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
5596	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4704	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4112	msiexec.exe
Token: SeSecurityPrivilege	2160	msiexec.exe
Token: SeCreateTokenPrivilege	4112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4112	msiexec.exe
Token: SeLockMemoryPrivilege	4112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4112	msiexec.exe
Token: SeMachineAccountPrivilege	4112	msiexec.exe
Token: SeTcbPrivilege	4112	msiexec.exe
Token: SeSecurityPrivilege	4112	msiexec.exe
Token: SeTakeOwnershipPrivilege	4112	msiexec.exe
Token: SeLoadDriverPrivilege	4112	msiexec.exe
Token: SeSystemProfilePrivilege	4112	msiexec.exe
Token: SeSystemtimePrivilege	4112	msiexec.exe
Token: SeProfSingleProcessPrivilege	4112	msiexec.exe
Token: SeIncBasePriorityPrivilege	4112	msiexec.exe
Token: SeCreatePagefilePrivilege	4112	msiexec.exe
Token: SeCreatePermanentPrivilege	4112	msiexec.exe
Token: SeBackupPrivilege	4112	msiexec.exe
Token: SeRestorePrivilege	4112	msiexec.exe
Token: SeShutdownPrivilege	4112	msiexec.exe
Token: SeDebugPrivilege	4112	msiexec.exe
Token: SeAuditPrivilege	4112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4112	msiexec.exe
Token: SeChangeNotifyPrivilege	4112	msiexec.exe
Token: SeRemoteShutdownPrivilege	4112	msiexec.exe
Token: SeUndockPrivilege	4112	msiexec.exe
Token: SeSyncAgentPrivilege	4112	msiexec.exe
Token: SeEnableDelegationPrivilege	4112	msiexec.exe
Token: SeManageVolumePrivilege	4112	msiexec.exe
Token: SeImpersonatePrivilege	4112	msiexec.exe
Token: SeCreateGlobalPrivilege	4112	msiexec.exe
Token: SeCreateTokenPrivilege	4112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4112	msiexec.exe
Token: SeLockMemoryPrivilege	4112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4112	msiexec.exe
Token: SeMachineAccountPrivilege	4112	msiexec.exe
Token: SeTcbPrivilege	4112	msiexec.exe
Token: SeSecurityPrivilege	4112	msiexec.exe
Token: SeTakeOwnershipPrivilege	4112	msiexec.exe
Token: SeLoadDriverPrivilege	4112	msiexec.exe
Token: SeSystemProfilePrivilege	4112	msiexec.exe
Token: SeSystemtimePrivilege	4112	msiexec.exe
Token: SeProfSingleProcessPrivilege	4112	msiexec.exe
Token: SeIncBasePriorityPrivilege	4112	msiexec.exe
Token: SeCreatePagefilePrivilege	4112	msiexec.exe
Token: SeCreatePermanentPrivilege	4112	msiexec.exe
Token: SeBackupPrivilege	4112	msiexec.exe
Token: SeRestorePrivilege	4112	msiexec.exe
Token: SeShutdownPrivilege	4112	msiexec.exe
Token: SeDebugPrivilege	4112	msiexec.exe
Token: SeAuditPrivilege	4112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4112	msiexec.exe
Token: SeChangeNotifyPrivilege	4112	msiexec.exe
Token: SeRemoteShutdownPrivilege	4112	msiexec.exe
Token: SeUndockPrivilege	4112	msiexec.exe
Token: SeSyncAgentPrivilege	4112	msiexec.exe
Token: SeEnableDelegationPrivilege	4112	msiexec.exe
Token: SeManageVolumePrivilege	4112	msiexec.exe
Token: SeImpersonatePrivilege	4112	msiexec.exe
Token: SeCreateGlobalPrivilege	4112	msiexec.exe
Token: SeCreateTokenPrivilege	4112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4112	msiexec.exe
Token: SeLockMemoryPrivilege	4112	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4112	msiexec.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
4112	msiexec.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4288	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
168	taskmgr.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4704	vlc.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4704	vlc.exe
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3708	2160	msiexec.exe	76
PID 2160 wrote to memory of 3708	2160	msiexec.exe	76
PID 2160 wrote to memory of 3164	2160	msiexec.exe	77
PID 2160 wrote to memory of 3164	2160	msiexec.exe	77
PID 2160 wrote to memory of 3164	2160	msiexec.exe	77
PID 2160 wrote to memory of 2000	2160	msiexec.exe	82
PID 2160 wrote to memory of 2000	2160	msiexec.exe	82
PID 2160 wrote to memory of 1528	2160	msiexec.exe	84
PID 2160 wrote to memory of 1528	2160	msiexec.exe	84
PID 2160 wrote to memory of 4864	2160	msiexec.exe	85
PID 2160 wrote to memory of 4864	2160	msiexec.exe	85
PID 2160 wrote to memory of 4864	2160	msiexec.exe	85
PID 4288 wrote to memory of 1788	4288	chrome.exe	94
PID 4288 wrote to memory of 1788	4288	chrome.exe	94
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 1352	4288	chrome.exe	95
PID 4288 wrote to memory of 4756	4288	chrome.exe	96
PID 4288 wrote to memory of 4756	4288	chrome.exe	96
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97
PID 4288 wrote to memory of 1356	4288	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TopazGigapixelAI-7.2.0.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AB41915201EA8629438718DE1F34AB65 C
  2⤵
  - Loads dropped DLL
  PID:3708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 167B443F8C3043A193F255E60E53D9A1 C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2000
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 58F6896B3D6ECED6F786141E599AE7E8
  2⤵
  - Loads dropped DLL
  PID:1528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CC389E2BAC849BB38FE84559E9D1072
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4752

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\CheckpointPush.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffecf49758,0x7fffecf49768,0x7fffecf49778
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4772 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5320 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3024 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2924 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5788 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5924 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5904 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5876 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5456 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5616 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2984 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5780 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5524 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5532 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3876 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6356 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6536 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6524 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5216 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7356 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7112 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7636 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7600 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7864 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7884 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7880 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7892 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=8000 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7752 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8008 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6012 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=6592 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6032 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=7288 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=7336 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6656 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=5536 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=8056 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6240 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6616 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=6628 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6052 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7208 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=2220 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=5216 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9276 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8868 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=8972 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4396 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8428 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=8852 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=9392 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=9520 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9748 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=9748 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=9316 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=8052 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7788 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=9556 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=2412 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=5044 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=10096 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=5216 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=7632 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=9848 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9464 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9292 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10180 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10140 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10128 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:6128
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5320
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:6028
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5700
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5084
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:3192
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    PID:5984
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9552 --field-trial-handle=1936,i,4203368480259152691,7797349752641518269,131072 /prefetch:8
  2⤵
  PID:320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2164

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390
1⤵
PID:5792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\MAS_3116265.cmd" "
  2⤵
  PID:1560
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:2004
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:1836
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_3116265.cmd"
    3⤵
    PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:3940
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5860
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
    3⤵
    PID:5484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:5480
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_3116265.cmd" "
    3⤵
    PID:5492
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:6092
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3564
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    PID:5888
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5776
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d "0" /f
    3⤵
    - Modifies registry key
    PID:5436
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_3116265.cmd" -qedit"
    3⤵
    PID:4884
  - - C:\Windows\System32\reg.exe
      reg add HKCU\Console /v QuickEdit /t REG_DWORD /d "1" /f
      4⤵
      Modifies registry key
      PID:2072
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:5280
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4828
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "MAS_3116265.cmd"
      4⤵
      PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:5560
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:5588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1052
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:2352
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:5764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
      4⤵
      PID:364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:5628
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:2984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_3116265.cmd" "
      4⤵
      PID:5672
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:5080
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:220
  - - C:\Windows\System32\reg.exe
      reg query HKCU\Console /v QuickEdit
      4⤵
      PID:2060
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:4280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -4 -n 1 updatecheck.massgrave.dev
      4⤵
      PID:4576
    - - C:\Windows\System32\PING.EXE
        
        ping -4 -n 1 updatecheck.massgrave.dev
        5⤵
        Runs ping.exe
        
        PID:5572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "
      4⤵
      PID:2944
  - - C:\Windows\System32\find.exe
      find "127.69"
      4⤵
      PID:5664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "127.69.2.6" "
      4⤵
      PID:5228
  - - C:\Windows\System32\find.exe
      find "127.69.2.6"
      4⤵
      PID:5212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:3756
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:5356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:1656
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:5532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3632
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:5180
  - - C:\Windows\System32\mode.com
      mode 76, 30
      4⤵
      PID:2516
  - - C:\Windows\System32\choice.exe
      choice /C:123456780 /N
      4⤵
      PID:5824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4172
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:5552
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:5772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
      4⤵
      PID:5128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:5636
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:5616
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe $ExecutionContext.SessionState.LanguageMode
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:900
  - - C:\Windows\System32\find.exe
      find /i "Full"
      4⤵
      PID:3124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"
      4⤵
      PID:5804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:6048
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:5696
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:5152
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:5912
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4448
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value
      4⤵
      PID:4872
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:3160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      PID:5064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      PID:2328
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:2004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      PID:4644
    - - C:\Windows\System32\wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        
        PID:1116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:5880
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:5944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:5876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      PID:5960
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        Runs ping.exe
        
        PID:6036
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:5868
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:6092
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:5580
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:5832
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:5852
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      PID:4244
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:3548
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:5148
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      PID:1764
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:2968
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:4320
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      PID:1948
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:1612
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      PID:4648
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:4248
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:3656
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      PID:2352
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      PID:2684
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:5372
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:364
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      PID:5672
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:5080
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:220
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      PID:4312
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4280
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:4852
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      PID:5572
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      PID:660
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:5236
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:5204
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:5212
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:5340
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      PID:5496
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      PID:5164
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:5184
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3632
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      PID:5720
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      Modifies registry key
      PID:5220
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:5784
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      PID:4172
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:2876
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:1060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      PID:5124
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      PID:3052
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      PID:5128
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:5516
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:668
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:4588
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      PID:5964
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:2132
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      PID:6140
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:5456
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      PID:3324
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:1852
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4688
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      PID:4268
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      PID:5260
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:6116
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      PID:2156
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      PID:4340
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      PID:2268
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      PID:4664
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      PID:1884
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      PID:5504
  - - C:\Windows\System32\sc.exe
      sc start DoSvc
      4⤵
      Launches sc.exe
      PID:3980
  - - C:\Windows\System32\sc.exe
      sc query DoSvc
      4⤵
      Launches sc.exe
      PID:5644
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DependOnService
      4⤵
      PID:5344
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Description
      4⤵
      Modifies registry key
      PID:3056
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v DisplayName
      4⤵
      Modifies registry key
      PID:5932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:5252
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ImagePath
      4⤵
      Modifies registry key
      PID:5140
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v ObjectName
      4⤵
      PID:5152
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Start
      4⤵
      Modifies registry key
      PID:2744
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc /v Type
      4⤵
      Modifies registry key
      PID:4552
  - - C:\Windows\System32\sc.exe
      sc start UsoSvc
      4⤵
      Launches sc.exe
      PID:1964
  - - C:\Windows\System32\sc.exe
      sc query UsoSvc
      4⤵
      Launches sc.exe
      PID:5692
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DependOnService
      4⤵
      PID:3188
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Description
      4⤵
      PID:632
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v DisplayName
      4⤵
      Modifies registry key
      PID:5384
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:5328
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ImagePath
      4⤵
      PID:2404
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v ObjectName
      4⤵
      Modifies registry key
      PID:2228
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start
      4⤵
      Modifies registry key
      PID:1300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Type
      4⤵
      PID:2296
  - - C:\Windows\System32\sc.exe
      sc start CryptSvc
      4⤵
      Launches sc.exe
      PID:4352
  - - C:\Windows\System32\sc.exe
      sc query CryptSvc
      4⤵
      Launches sc.exe
      PID:6016
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DependOnService
      4⤵
      PID:2596
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Description
      4⤵
      Modifies registry key
      PID:2328
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v DisplayName
      4⤵
      Modifies registry key
      PID:3200
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:5908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ImagePath
      4⤵
      Modifies registry key
      PID:5860
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v ObjectName
      4⤵
      Modifies registry key
      PID:5876
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Start
      4⤵
      PID:5492
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc /v Type
      4⤵
      Modifies registry key
      PID:5544
  - - C:\Windows\System32\sc.exe
      sc start BITS
      4⤵
      Launches sc.exe
      PID:5884
  - - C:\Windows\System32\sc.exe
      sc query BITS
      4⤵
      PID:5856
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DependOnService
      4⤵
      Modifies registry key
      PID:5776
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Description
      4⤵
      PID:2568
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v DisplayName
      4⤵
      Modifies registry key
      PID:428
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ErrorControl
      4⤵
      Modifies registry key
      PID:2968
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ImagePath
      4⤵
      Modifies registry key
      PID:4828
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v ObjectName
      4⤵
      Modifies registry key
      PID:200
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Start
      4⤵
      PID:5904
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\BITS /v Type
      4⤵
      Modifies registry key
      PID:5588
  - - C:\Windows\System32\sc.exe
      sc start TrustedInstaller
      4⤵
      Launches sc.exe
      PID:4248
  - - C:\Windows\System32\sc.exe
      sc query TrustedInstaller
      4⤵
      Launches sc.exe
      PID:4480
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DependOnService
      4⤵
      PID:2352
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Description
      4⤵
      Modifies registry key
      PID:520
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v DisplayName
      4⤵
      Modifies registry key
      PID:1908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ErrorControl
      4⤵
      Modifies registry key
      PID:3924
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ImagePath
      4⤵
      Modifies registry key
      PID:5156
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v ObjectName
      4⤵
      Modifies registry key
      PID:412
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Start
      4⤵
      Modifies registry key
      PID:4964
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /v Type
      4⤵
      Modifies registry key
      PID:2944
  - - C:\Windows\System32\sc.exe
      sc start wuauserv
      4⤵
      Launches sc.exe
      PID:5192
  - - C:\Windows\System32\sc.exe
      sc query wuauserv
      4⤵
      Launches sc.exe
      PID:6080
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DependOnService
      4⤵
      Modifies registry key
      PID:5984
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Description
      4⤵
      Modifies registry key
      PID:5356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DisplayName
      4⤵
      Modifies registry key
      PID:3060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ErrorControl
      4⤵
      Modifies registry key
      PID:4488
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ImagePath
      4⤵
      Modifies registry key
      PID:5172
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ObjectName
      4⤵
      Modifies registry key
      PID:5168
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start
      4⤵
      Modifies registry key
      PID:4440
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Type
      4⤵
      PID:5828
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:5780
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:5900
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4172
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:5440
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:5772
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4780
  - - C:\Windows\System32\sc.exe
      sc start DoSvc
      4⤵
      Launches sc.exe
      PID:5124
  - - C:\Windows\System32\sc.exe
      sc start UsoSvc
      4⤵
      Launches sc.exe
      PID:5524
  - - C:\Windows\System32\sc.exe
      sc start CryptSvc
      4⤵
      Launches sc.exe
      PID:5128
  - - C:\Windows\System32\sc.exe
      sc start BITS
      4⤵
      Launches sc.exe
      PID:5516
  - - C:\Windows\System32\sc.exe
      sc start TrustedInstaller
      4⤵
      Launches sc.exe
      PID:2276
  - - C:\Windows\System32\sc.exe
      sc start wuauserv
      4⤵
      Launches sc.exe
      PID:4364
  - - C:\Windows\System32\sc.exe
      sc config DoSvc start= delayed-auto
      4⤵
      Launches sc.exe
      PID:4180
  - - C:\Windows\System32\sc.exe
      sc config wuauserv start= demand
      4⤵
      Launches sc.exe
      PID:5964
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:5464
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2792
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:2092
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:5520
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3324
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:4000
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3436
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4268
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2904
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:6116
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4112
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4340
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:5740
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5632
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:5100
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:3896
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6112
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:6048
  - - C:\Windows\System32\sc.exe
      sc query DoSvc
      4⤵
      Launches sc.exe
      PID:5680
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Start-Service DoSvc
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5596
  - - C:\Windows\System32\sc.exe
      sc query DoSvc
      4⤵
      Launches sc.exe
      PID:2012
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3108
  - - C:\Windows\System32\sc.exe
      sc start DoSvc
      4⤵
      Launches sc.exe
      PID:5296
  - - C:\Windows\System32\sc.exe
      sc query UsoSvc
      4⤵
      Launches sc.exe
      PID:3160
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4776
  - - C:\Windows\System32\sc.exe
      sc start UsoSvc
      4⤵
      Launches sc.exe
      PID:4984
  - - C:\Windows\System32\sc.exe
      sc query CryptSvc
      4⤵
      Launches sc.exe
      PID:2244
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6020
  - - C:\Windows\System32\sc.exe
      sc start CryptSvc
      4⤵
      Launches sc.exe
      PID:5400
  - - C:\Windows\System32\sc.exe
      sc query BITS
      4⤵
      Launches sc.exe
      PID:1048
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6108
  - - C:\Windows\System32\sc.exe
      sc start BITS
      4⤵
      Launches sc.exe
      PID:5864
  - - C:\Windows\System32\sc.exe
      sc query TrustedInstaller
      4⤵
      Launches sc.exe
      PID:1844
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Start-Service TrustedInstaller
      4⤵
      PID:5480
  - - C:\Windows\System32\sc.exe
      sc query TrustedInstaller
      4⤵
      Launches sc.exe
      PID:312
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1080
  - - C:\Windows\System32\sc.exe
      sc start TrustedInstaller
      4⤵
      Launches sc.exe
      PID:4248
  - - C:\Windows\System32\sc.exe
      sc query wuauserv
      4⤵
      Launches sc.exe
      PID:4480
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Start-Service wuauserv
      4⤵
      PID:5388
  - - C:\Windows\System32\sc.exe
      sc query wuauserv
      4⤵
      Launches sc.exe
      PID:5184
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5172
  - - C:\Windows\System32\sc.exe
      sc start wuauserv
      4⤵
      Launches sc.exe
      PID:704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo TrustedInstaller-1058 "
      4⤵
      PID:5720
  - - C:\Windows\System32\findstr.exe
      findstr /i "ClipSVC-1058 sppsvc-1058"
      4⤵
      PID:652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:5780
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:5592
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:5552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_3116265.cmd') -split ':wpatest\:.*';iex ($f[1]);" 2>nul
      4⤵
      PID:5440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "$f=[io.file]::ReadAllText('C:\Windows\Temp\MAS_3116265.cmd') -split ':wpatest\:.*';iex ($f[1]);"
        5⤵
        
        PID:5772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "14" "
      4⤵
      PID:900
  - - C:\Windows\System32\find.exe
      find /i "Error Found"
      4⤵
      PID:5760
  - - C:\Windows\System32\Dism.exe
      DISM /English /Online /Get-CurrentEdition
      4⤵
      Drops file in Windows directory
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\A37279A5-B65B-4049-AC80-632AAFE42BD5\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\A37279A5-B65B-4049-AC80-632AAFE42BD5\dismhost.exe {6BDE031D-42D6-465D-9A5E-F47599621A15}
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5476
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -2147467259
      4⤵
      PID:6096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID 2>nul
      4⤵
      PID:792
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID
        5⤵
        
        PID:2880
  - - C:\Windows\System32\cscript.exe
      cscript //nologo C:\Windows\system32\slmgr.vbs /dlv
      4⤵
      PID:5472
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:5656
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:1192
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:2160
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440"
      4⤵
      PID:4336
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:5124
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:2516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      PID:5476
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:6132
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:4180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      PID:5464
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:2644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      PID:5052
    - - C:\Windows\System32\wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:5144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "$acl = Get-Acl '"C:\Windows\System32\spp\store\2.0"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"
      4⤵
      PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "$acl = Get-Acl '"HKLM:\SYSTEM\WPA"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"
      4⤵
      PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "$acl = Get-Acl '"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}"
      4⤵
      PID:4776
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v SettingsPageVisibility
      4⤵
      Modifies registry key
      PID:1964
  - - C:\Windows\System32\find.exe
      find /i "windowsupdate"
      4⤵
      PID:5284
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress
      4⤵
      Modifies registry key
      PID:5932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s
      4⤵
      Modifies registry key
      PID:4352
  - - C:\Windows\System32\findstr.exe
      findstr /i "NoAutoUpdate DisableWindowsUpdateAccess"
      4⤵
      PID:632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo: TrustedInstaller-1058 "
      4⤵
      PID:5620
  - - C:\Windows\System32\find.exe
      find /i "wuauserv"
      4⤵
      PID:5912
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v DisableStoreApps
      4⤵
      PID:6028
  - - C:\Windows\System32\find.exe
      find /i "0x1"
      4⤵
      PID:5976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 221a02da-e2a1-4b75-864c-0a4410a33fdf 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 8b351c9c-f398-4515-9900-09df49427262 b0773a15-df3a-4312-9ad2-83d69648e356 bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 e7a950a2-e548-4f10-bf16-02ec848e0643 ef51e000-2659-4f25-8345-3de70a9cf4c4 fe74f55b-0338-41d6-b267-4a201abe7285 " "
      4⤵
      PID:2148
  - - C:\Windows\System32\find.exe
      find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
      4⤵
      PID:5256
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
      4⤵
      PID:6048
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:2268
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      PID:2332
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:5548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      PID:4300
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:5480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "Set-WinHomeLocation -GeoId 244"
      4⤵
      PID:5472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))
      4⤵
      PID:2072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;PKeyIID=465145217131314304264339481117862266242033457260311819664735280;$([char]0)"""))
        5⤵
        
        PID:5412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "TwBTAE0AYQBqAG8AcgBWAGUAcgBzAGkAbwBuAD0ANQA7AE8AUwBNAGkAbgBvAHIAVgBlAHIAcwBpAG8AbgA9ADEAOwBPAFMAUABsAGEAdABmAG8AcgBtAEkAZAA9ADIAOwBQAFAAPQAwADsAUABmAG4APQBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgA0ADgALgBYADEAOQAtADkAOAA4ADQAMQBfADgAdwBlAGsAeQBiADMAZAA4AGIAYgB3AGUAOwBQAEsAZQB5AEkASQBEAD0ANAA2ADUAMQA0ADUAMgAxADcAMQAzADEAMwAxADQAMwAwADQAMgA2ADQAMwAzADkANAA4ADEAMQAxADcAOAA2ADIAMgA2ADYAMgA0ADIAMAAzADMANAA1ADcAMgA2ADAAMwAxADEAOAAxADkANgA2ADQANwAzADUAMgA4ADAAOwAAAA==" "
      4⤵
      PID:5696
  - - C:\Windows\System32\find.exe
      find "AAAA"
      4⤵
      PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Restart-Service ClipSVC
      4⤵
      PID:5444
  - - C:\Windows\System32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:204
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:5388
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem9393.tmp
        5⤵
        
        PID:6140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"
      4⤵
      PID:5512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')
        5⤵
        
        PID:5952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:5320
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:5304
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey<>null" call Activate
      4⤵
      PID:5976
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:2148
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value
      4⤵
      PID:5620
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "Set-WinHomeLocation -GeoId 244"
      4⤵
      PID:4168
  - - C:\Windows\System32\mode.com
      mode 76, 30
      4⤵
      PID:5228
  - - C:\Windows\System32\choice.exe
      choice /C:123456780 /N
      4⤵
      PID:444

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:4452
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\tem89A0.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:4484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
PID:5608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:496

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket

Filesize
1KB

MD5
67a8abe602fd21c5683962fa75f8c9fd

SHA1
e296942da1d2b56452e05ae7f753cd176d488ea8

SHA256
1d19fed36f7d678ae2b2254a5eef240e6b6b9630e5696d0f9efb8b744c60e411

SHA512
70b0b27a2b89f5f771467ac24e92b6cc927f3fdc10d8cb381528b2e08f2a5a3e8c25183f20233b44b71b54ce910349c279013c6a404a1a95b3cc6b8922ab9fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
9b2abebf8f0c6eb4dc665ae11c0ee028

SHA1
45f17123df636f53e9c700e1c3210f8a4dc0bde4

SHA256
3e0cdf305f089b65865b6485aae4b49b6b3d46e53c7691f75000ccef01606cdb

SHA512
ad92be09c99ede174527cdc50fc13816594c392f75775ad91ef5dc4bc3fedf676427540173c3323a7c5a90dc105fb0970a38969de4d08ca21572c3637419537f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E

Filesize
727B

MD5
999d655f4f64dfb88c69d2a501570543

SHA1
7c80ac9a21f0f340f3f09e992f592a0911d43f63

SHA256
d489cd27062d241acd180d88f4e664d2a046eff1fd58dcc75cf8065fb26c223e

SHA512
2f966658f376510616e96f1e6c941431b22b4b02ce66fbbf507485cb72fba4fc0ad75348554d6848c7ee37e9cd15cbfdb300c8ad7018dee4f68f445666dbc49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
e7e9c627db86a5541af48f23ae26f920

SHA1
dd50c3cb3233b4e7f494e72bdc59caae72365001

SHA256
f15255eb11089366af0f0c6644a0508d56550db1f5626cb89dd200287aa6534c

SHA512
e5991ef3019d93f4352f9d03d5257068db24ba029ea6805382c531033e1dcb1c2397b66080bdcbf04866e54d7c1b85f802966042878ccd56a807398162c962f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
f777913554bcb1df5cb7c564c6e18460

SHA1
c61603e239e46d41d5b82f2962baa3ff62a2fda4

SHA256
9b84c25c30de331e8e9225af466ca272d21c497efbca1fd83c670122ac105542

SHA512
43ccb8e42a2e58dd65893fbfcf2ec69ebad481ef129d55a1afe342c2f51974a8885e72ce87ea1eaecf33469b93ffec789e58cff2146d0b0b915ca201e5be8d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E

Filesize
404B

MD5
e6bd80d4f52d3911cd9c25298c8fad18

SHA1
6031a7e9e480a39d2f96d94ead08c07e60510a3d

SHA256
d154e1f84107940d39adddad7a8969757f6a06ce9e41dc27f30b8cf3534fa1cd

SHA512
5884de44b2e1cb498f592b7103b905b4327588f22a533f8e201343450827c4fe7bfdcfc31ae066ab9e839889c74a9080130f9d7842585b821bf08e79f1898856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
0c4106aacfd3d848813aeb999517b4f0

SHA1
5737c0b61a5d8bf07acdda850af31eca17970b5b

SHA256
419f003a4487d3365c7de1ad09bfdb8bb565e08ae9ec66768155cfcb413957e9

SHA512
cacb75aaa75c0d875337918d00ba061ae461629ec444ba73f9743f856433299b14cb9721b4f9ac84d67cdf5b685cf1260e3d06d33602416d35854ef8b26b7e1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
59KB

MD5
33d2dcc9ccf87d6ed728ab0c46235369

SHA1
249e080a07601d8537b242546067229f49a4aca1

SHA256
a455f1cebb519dc1861af1646224fb2cff08843469c0f346d93efb6745615c4c

SHA512
754e230d5ed0a578559702f43312b2cb2b282676a95218ec3213efb566fed6ca02034bc6dc7ba124afee6f9b766a0680a8e51ea377b998eb2a10d0b7de67f7cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
40KB

MD5
aa12ea792026e66caab5841d4d0b9bab

SHA1
47beeba1239050999e8c98ded40f02ce82a78d3f

SHA256
65fe153a832452e97f5d484440a7047e314d3a83cb61ad2508fed48a820e1de1

SHA512
0b2b1bb8851c60c9d4ab1d039b990a4de5799c97c50b45f64e36a21849c14e785f69196f674ac225b1419d7f501338054074cab6203d041361a4fa1ed8802b27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
69KB

MD5
c356a0c771a0209d3482777edfc10768

SHA1
1ff2d992af8a6f19c30ecbe8f3591f26fe1cab08

SHA256
32381f4549d36fa4583e599adc04056a4da80a6067c6805b7081c3f3f54a27ad

SHA512
561084baf8d65579ead79e79c2c3920ef987384d52ecc11a2689aff95c54a6b823a0c4a8e5b910e60e569450e36563f53adb5796f261f13bbeea59130b81fe3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
327KB

MD5
af3899196275dae45500fc7671ba1a97

SHA1
8baed8b4951ae14677fa093e56d5540f6d989372

SHA256
7413bc9ead0d8ece381038166e278e2554908209d8a084e961fc18eab8ee6c7e

SHA512
32a8c08b55013ebdc62eb9b1cfcaf54a8ce7ef7ab3dd208a30a3cd1f6281cafc7d667e0c19ffe6dfbea8be5cf53df9509ed0c34337d8bfbad0723aa620542d3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
133KB

MD5
fd2c40ab6f28f98b083ddd7d14bdced8

SHA1
8bd5fd35434b0dc61620e527eb935bc294de9bc8

SHA256
b8b68b20bab08cd4e19b8b20abd676b5ab0e8d3bf04f61ff5e9d2207e5b292ff

SHA512
31e8abaca6af52cd0232c1cb552a015106ef0b09c224b49a2dff4fbec5afb5a951163693b5b113fc6803d928a1ec999269f7d7ea997462e22b731ea39f898f61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

Filesize
65KB

MD5
f3dc36eb8d102c5b65b1a457ea739ef0

SHA1
b18742e75723d4379811ec5cd6a714d5841878e1

SHA256
7b8db0f76ae02660aeb9294c337153d4365ea193c2e9c0ddd4ca2a54fe7457c2

SHA512
db56010e8d7b5f831d64c4daa8ccdeb21deba6ce5b4594f065eb942d551c56c6174a306ee17b3359cb7260f512dfdd645ce0b62bff992bf0d2a96e9771bdbce0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
151KB

MD5
9e558c0a05d0b88832b9218c2e62c32a

SHA1
52e3851ece96e1b596bfc2b4ff74b16dbf9d3aca

SHA256
bd1b339e5b2794a103c53498779af78e52a9c49012a44a265df352e0f53e3801

SHA512
d48ce11107f8eca903755a62002e597bc30e50f63935331e177341b54ca567fffdfd6646202a1f9b6136a46d15a4ec9fa9eb211e9300a9c4affae8f3d443b5a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083

Filesize
19KB

MD5
0f0c9989cbb18447d2f5d954c20ed99f

SHA1
9ad0fd560c0c478c67cc8f118e363b3a1d1cdb5a

SHA256
a43a9e5bbd2d8a8aed070df3b2c799afe064312d6f248c4a498a67c0f9a02720

SHA512
ad6a2c60d3e5aab48497169e380d0fa50d7a0fd2bfa0a07313d880afaafd2ff2be7521864ab7ec661866b1ee4309467ef2733a24dba7e0facde8d190739d9fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000084

Filesize
46KB

MD5
f871dd44ae8c9e11c5c85c961f8b2ab1

SHA1
7618910822a0f2639b405e3c0b13faff0431140a

SHA256
2ae2564f74716a4e44850d845f0cca255c6c0c3a7dc0c8ee6bfca0212cc394ec

SHA512
3b9638f705f83e37c3e0c9db1205b2ac76b96ba72ac56013a6aca6f34a7a9ff3548e8fc67d2b85c9f23f8337f696baa8fab01523fb04b5fd618b130501eed47c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000085

Filesize
96KB

MD5
faa475d077f88260d6796a46fd5656ae

SHA1
92900a3395076a8021aba31fc975fdcef4bc60a6

SHA256
e84fdb3d44a150998bf6846bc5519a66a97eb1e1462f3b92a9bfa997079025ba

SHA512
98cd54d3022b9f11f9819c729d20df829345ba930f5399308f8bb4b810bb9b7db739c4f7eed33bcb294823661ec1217096f457159bd1fde54b10b75253d90bf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000086

Filesize
164KB

MD5
4d556c2cc10f8727638e49463b7d2a89

SHA1
257179478e9f824988c329ac72563c9aaf7bf60b

SHA256
ca0f78aad838f0e3fed01621284f941df080cf134c14768f9ae104fc47c996fb

SHA512
3146f1d3b6a0bd3ced1231d313d23591ad14a680b08f75403c79a22c52632ebd279fb05a11918b060b860751633eada4715d13b066fdf6867222f2506ad10a65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000087

Filesize
223KB

MD5
a06dcd12ab1eab766d22c22b772435e1

SHA1
de36891470ceaa364c65e9e31998aa1f1a0d4b03

SHA256
eccc0756122ada1ed0f4f7df11d6445e980c44de3e6cd961271c821a669623ee

SHA512
3998d3656f3e4e68a0507b51a6aab8251602dbd439839729eadc55e352c35ad81c1da0bd8cafd82dcf74ede5d7daaee47e1f37dcc6f6b308f5d1e355850f7b29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000088

Filesize
42KB

MD5
8f1f73a6bbe39bdf9491f7672b28db4a

SHA1
17e1b5e01c6ec0fe14e5091c4bcfebc17c0c0f79

SHA256
fc0f0e634256ad4acba4e91d7dbe8f18d90b5daa7c5868a5e2115cd45e41c92b

SHA512
ea228c4f2126a188005608488b2d980d36984a06999d8fa5a00ffdf14073e4a00d417518fb1716f664394613bbf1ea70b74ad6d12335d1afaddfab51d42538f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\00bd7c07b024709c_0

Filesize
19KB

MD5
17d9813d7ec4db3e30f56b24d447743d

SHA1
c17ebe8fbc1a650984549b59c3c008cabd905300

SHA256
4475d0a3a7a739e8dd63954a25e8b07af145b5f1acba812c20393d4e5ab50901

SHA512
b323068d56dcd937ec64781e6b1eefd24b49aa0af2d26bf78bc43945c3636caa55e65022b86944796b466aeefb1e5e54bd2aa969958d192da81f272c193ab305

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\32c47aab1ffbf583_0

Filesize
2KB

MD5
afdb7dc42846dbec1823025f9e01bfa0

SHA1
130f739b16156b511d94c581b72d283aa5ea9383

SHA256
dc6982daa89dac30040a37b942780dbdf133f2cf5ccdc0b64bc8154631f9a7e7

SHA512
d2c82d82c5832a11447a3c7937b352ae6b71191722ba3307c9521ac2acb1e4413cdf8db98c11eba46ea13fa1cf686423cff31c29aba29369b54a793508d20746

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3f53680f7630e8e8_0

Filesize
347B

MD5
aa24196a069b4a210228f91b132e8e25

SHA1
743fcb27add36450822b6da7c59253e3c1e0490b

SHA256
28113a8ffcc546fdbad3d52811e445f41d20bae188266fcef101af49d38a62b0

SHA512
a28c0e4e98ba808421c501d93f6916583fe522a063384ec76f8c4389d615e0484a6c1291f945d308ee22eff3dd118c9c4b72c3475c824db77d27a1e1e005aa0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\64400c90f7125a6b_0

Filesize
230KB

MD5
c381748927facb78f4c52208b5d18b3f

SHA1
2fbadd23b9405d622bc9904fc060253c01bf83b8

SHA256
016175f5bfb0966ac96a55ed6ea7d6965473519c124afb471ee38235eba7f340

SHA512
09c18858e8a0f24b640b27e809ac9bf2e2d25d8755da17af9c694a999bb9a57a03d4bcb8b2a9caff33fffdb9e522487f1b89176e652ec5f9573e6c6b2d9a0ce5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\764b1d6cf58274eb_0

Filesize
280B

MD5
3b6505c37a9ee9baaa9c62cefe50108d

SHA1
f4aa79c51f90a9ce2c0237f97066af5ad5b6801b

SHA256
24236f54a5eceb287c46aeb1971252e196cd18cc17f52e39eed51d39a97dd0b0

SHA512
d803525dd13fa801446e37849e6724bb1cbe17295c0ca1f34c0314f1705cca6b00b96cf146fb2de1fffa2063314dc6aeeb9b460fd9259568eedbdc71ffb6eaad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\98b14c47a75f8cb8_0

Filesize
1.3MB

MD5
6a7a10358609ad23be6c11b913d97c8d

SHA1
213808cf9d5a015d2d3b247a243d3a9ba838f862

SHA256
2c66d82cecbcabe063a30571331b233f0334c87bcb6e80ad31f02a39e851855f

SHA512
8ee8f39b7bcc59e0515ef1b31a683541d1c16b5f06a78b75628fe9feaffa7cbde8aaa75e08384be55291b9017e79f4de5245bd3f4a9f87bf37eafa9ee8ff468e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
8e06cf79260625fdcea0d45abe34d3c6

SHA1
3c2e7e26bcfc1cce21527d122bce15007c40b869

SHA256
4617b2b37b8d17a092af9e51b43794dba973f44bdfdeff4bccf1b4482c296f99

SHA512
f3a15407b9babe6ee4f9d0ec7e71c66fd1dc21bea479281bcb1e0f0e216579ec08434d080851d992e4da92ab6ad6cef7ee1a71655d7e7ddf752923993bbdefd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1e9abb55b6f32313a9969a45d792635f

SHA1
a9390ae36d950035f5607ad2f7794a759a9c981a

SHA256
851d60425100a9e856812412213f9e63851e3f70ce45a24dd24dfd106a339592

SHA512
c8cc68ced10348a380872e379c4214b3ee66c82efc640422b14aa8456b7b4e533ac9f9125a2c7866f1b73c0ba57114c604f6df08691169a45f84b407b7dcf939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
0e43ca93af802be851123ff074af0f35

SHA1
fb68adecbe61ea42ff27ac464747e39cd4b9eb0c

SHA256
d6bc237f8f2f7bede518438f20585eeab55a7258a90c93c95e47262079abe89c

SHA512
2beadab652080a4feb41a737465df3fa960978772aa10abbf4fc4620753e0848dd29ecb531b8d2ed2d63f78fe6e510e8afa15edf4c49fc93b55ab45cecd891c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
435bd563881af8a04aa1cdcf0c0f3868

SHA1
86774ecd8c64204974383a7e1a017bb1308ba675

SHA256
d52dd9f6ee523d7bfcc11f3b735789c259c09a993be29759bfadbcf9177d9794

SHA512
54596f4032001c8dcefaf7e2fb44637b1c0a928f914109373b93262a4677c00799bbd9e4d1d9604af9616ab0ad5f6239f97aab900d073758315b738a400413fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\89195ac4-b05f-4b6f-bb5d-6a2795bb3671.tmp

Filesize
8KB

MD5
4e33105f16af9525cdf9afd339c08a53

SHA1
7db8872978569d7a506b5c57e8c87c2dd79ff1a7

SHA256
27857cdec8e5d9521047fcbce4f6b17dbfc5eb69eea7c784b78bbe2f29605bf7

SHA512
9872be08d1c7529f387b74619630bc243cffedfc8f8b5de7508413bd7c114f5bc2a14a655d9b6cfe81a37944acf1acf992422c08a6c8b5d80a6bb9fe41f958f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
67574c5efb5c75e837b7a3987e96be0b

SHA1
d2c2d779f1c5c8cb8bebec5973164eb30199277e

SHA256
6b17d64140a892821163240e445d793e8472ada14f559880e93deb08ad0ba4e2

SHA512
1ec982cd7096aebf448f98f43ecd5d34c7c52e68e329ceaf45b7fd316713f26006a9e93b556a898dedb1fc1612e2ad2ab5a1c57cb451a1006d990a5280bfbab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
16KB

MD5
429dbf3435abc5335e92ca2719a3f260

SHA1
b5416f39c38f30af38a267ffa90a1a32ee1363bb

SHA256
fc538fda25a9ad2b0818b959068ec14e4d3089203b7feed0c4a5d2e144f4381a

SHA512
69a5e8271f776765652c6dc5e4ea35cdcc1698ff791c9b200d5296b45f229ee76f5cdb9875f84674d6dbab9235ab6abfa5352c33d40a4acf12994b9121de2ebd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
878eb2838a48525876a5ffe2af7fc1e1

SHA1
6cd3010a1ce028c641ae27daf3fb8d554ddbca04

SHA256
cfe5aed1b7e71d31a3866d504ba61894b6326a4596c24f318d0ccae18bdd14bb

SHA512
158b7d70bac7c069fcc1dce605c39656681cfef2ffe5ba4f705df77ef0451ad510d6d19411c79453991e467fc9243d873e432b247f95d450b89a41eef445bac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
7a31ecb7412c51e3b22d13bb46c286f1

SHA1
813f2184bb3ac82987cf86ea8aa189ba456acaf9

SHA256
bd8f9edcde8783fa5124ad8f6d10cb169128c306e18073922c4dfe1bcf7da8fa

SHA512
78b2e9fd09ed99b96aa234a956051c7f7a527c754cdf85865132848973298cc969e985cd929e5b29ddaa0561a44bd05edc78d9172b53c64822769102a7eda9a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3e4c39e75bde2607a06f0344666cc265

SHA1
1b845e7d6d1a2f014b10405abff538d3fcc777de

SHA256
c2b18fd27465aa0d2d3f2e86c63f702855b106ae047966ecf80048fc5892a972

SHA512
a0633360d11cbe3aeb1f202f1a431925b1b7132133f6ae75eaa7f8718b87a84ecd18a3cf3b02e67ffb3ca599008f62993d95958af858590d9b4073b78c741368

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
f228881d97deb6f487047a41c472f630

SHA1
42fc177f6828a0820726d2cd97a4a778e632dd3b

SHA256
e4100935eaed83dc4a37b15ea22ebabfa7ab04338ae4b73e6e8fb74bbcf60d47

SHA512
4b717bf1e8a6bee760f6c731a240cb6b8ef0683db2013d6107776bfdd157be47f6d7537bd4eff1ed14fc61bf9709bdead239dc87a018358b6f30cc801bf03459

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
cc0a5e145c1fdcc71d968a5ff1cbbbdb

SHA1
1d04d6cb07b6b88cd333d648943e254535b81523

SHA256
85630c22d5e024c41efb7591d76a18c50c5e9d53bfe7a3577f21d80f4401f8fe

SHA512
d4e389505331fdbe45dc1e93fd31930e2127d7268b0e5e3275ffe23c94332f8224c94fa774e44283b5ae15908d1c4c941ddd41cea6f6f12f17bc3a9b5f55f36f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
91b0ca2d1844f7ea1eb8bbe83ac31ef4

SHA1
ab1b82571521b569e0612820839add0eb9c809db

SHA256
19b6d00181a79d640bf16c1b15b44849f6faf1647ec4d680affbe8816fd86493

SHA512
5f62c77a2e5330451fe2d829651fe675212f01051f61adc703f36c4d30b385d133180bfcc08fdfc8f3c1253bb159bc52f7ae4e23cab19506dc12eda9141e7ec2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
672efb2cb2e6e12e473946df7ba1a493

SHA1
06de598850f746c05372410bc60b896c9476683e

SHA256
a466a2f693f55b3c96ec320451234b64de95d06ef9f4c4c730807fe809b66087

SHA512
a9572f14fc07ca7e2dfd0de4b694b12698ae826e85b270bc8f2f8795353eed935a2287bb7ce5072d84c582d74ab48a03af55b5e3ab0e052b1d0c52721edbd46d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
c867f539a051d3a9d790f2decb7bbc1e

SHA1
c2957d969e34f455482af2f9cad894ee942d928b

SHA256
b892823d8fd5efc342c66223ad38ba516bef004061eefadf00a85be07a792240

SHA512
3e7f8bcf7547b455bff33966b41a3dfecee58af3bae440d3ca8be100a425fb89b030e5a91c7c416373d69faa50193b6a6adccb9f7ab6f77ebe58e8037c764d9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
9f744e65358deb8ecd533fc324e80ff6

SHA1
e39b0534ee246974d00cc9de35f4cff3e9a4b391

SHA256
db034961c8d0fcc8902c714f4313dbce41ebc296cfc20b4c4e55a1aa128feb34

SHA512
d053f402b3ab266ae8933431e96c228db2f1c9a0b62dfea522b977977c8264a45441bc42fca0a7e9b90af0d33101f455a80d0de44c190c9ffa05bf103d8f5898

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
7f8d85fcd83737cf21a51e0998486232

SHA1
40eef7fea8eb4716f4fb6e218d61507b56e8df86

SHA256
b322cc5c683aeaa7ecbf14b75c6a43fccc6e6122a55dd0e5fe9635cfe888310f

SHA512
c13e7c6d881cbe07e8aaf8a7ee2d00fbdadab50a79d3e155cfca6a31fd70f7f07b89d4555fe1b91d99f783dcd6dc8a484bbea2e08851fa219f2f55079656c89c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
0b3aebd65a1cbf8cebed05729da4fb2e

SHA1
06921c52b7c1c19b6ba59cf8381ec4ea2bcf3db6

SHA256
4a5f05bcf994f77d141e67b3912eb0dc045d62566e24efd358c5cb14a219373e

SHA512
e2a309acab12a45c19b49d15d44c87f9f8ea7758ce1e58a0c61c2db69103c517d9a4d572a5d16b35482d3cf69998cca08bbc2698bfef8a753cbc907c1097bfcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
b64ec11c764731166918f5256adc09d9

SHA1
1de686c7f844faae3a89291631de29ad5289146a

SHA256
7676540bfedcbca0aaf7dab1aa640fecfa648d08fc7c4e11f5d8104670691183

SHA512
4bd7a0d34e6b38b9578428db7899821f91114787362c5b26d9b7d558ba7aa3087a9bfaa46fae78c942af4a08191bc9bb41c2ab7217b51a8721dc83b33eb23c5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
159fa0e0a351a7c46df85aafc1fa831e

SHA1
fba5d324caa63a3cc81bc61a33a0c110f242b3b5

SHA256
10e30aad338769f9c85b752091733e5570b435d480d1dc7336631065cfd116fa

SHA512
ff0561b9303c2761dda258d72cdb85e19ec49fb1b8a367db5dcdeb5b660550c647154f9768cd17b1fa3ef513ba40fe6b1c6466b658b40502e5a4f43efa895ba4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
ed866feb2eab37212b8eaa6070f7c639

SHA1
40a1b8f4ce40badc7d08d393322e5a9fdc9ef840

SHA256
00e27e52b197cbaf49d5cf954891af4d727be85f497c12dc475e61cb616f8221

SHA512
9fee7dcfbfc590002fd6c2aaa0897ea2827424e5578fcedc306205966d6764b864a7158ef4e859b5ce089f407856a6f2575cf0785f47fa35987659b3d11b21cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
a2a2fc03b52245e7ebaf4bb7f2ab4013

SHA1
96df0f5b3095f5bb713b83291add22e2c2e04c09

SHA256
5115130627874ee9c52e826ee83c9ae6b160ea4922947b52f579947219036dc5

SHA512
b6f20a7871cdff08fa42b7cd6b81eb81ad8ebcb39e4fae96a91392bcfc134dfb787cef2a53f4cf41cbb5c64a84be3ecad4f68cac5842dd1bd82a202b31e220cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
712564f56549eab814b1d3820fdd4d84

SHA1
c2253194926d36f37eb964384a945ace0cd36ada

SHA256
2b42045bbbe17abd0a896bd08ace253d28d57aa11737b5b8905c7ab250e438d1

SHA512
4557ce50e625e8b3fab6404ea87b50b2e289ca09925a0bc1f4d7e549a8c6b0d56109d7f2b7ab400da7b1fc0f8e8e715a094e67f33362d2309e11864e1f2f0cff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
ffe15526a5cebce1246be47676bfc6fe

SHA1
50fe84ed1efb85ac182f5c87bed04f62ff279f14

SHA256
6f7bbf81d0df4514ba66ffc0f18cd8d61c4a02f0c5b26f36bb461adfd18dc318

SHA512
6d2e494d70ca36de1ce422167706d4d49ad6df5f9904be142ade45c1574185ceff9e09186635f7936379581fafbca4f66afe1f78c52fa0ad4280c377d32666da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
07bb3ee70b890679e262d714bd1f0dee

SHA1
04c3a19733f6f1514ba44963ff874f6dfb06edae

SHA256
2266e242f56b112dae044cc94d54986c701ae44a110f4381397640c7a03347e5

SHA512
1963ee634cfc8f26a77058d50dba063ce33d27b208e37b509fe21f3de07649dac9c478ff164c87e218ab4486c7780056b456b13a6b9e36cc919ab178757a2319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d84c35f7c14eac686bf886395e0aa1c6

SHA1
9bdd8fd52b841838fc5a5b1e060609b936c65fdc

SHA256
c64e9b86361c0774a0d8c82f09b9fd49b7794003169330613b1a28bca86b9dbb

SHA512
1fc15fe897a65c3c9f222755bcac844cb9da65bd3354b7e45dc3bcbb6b91c891d0b64ddf096eed103098adc6d6bd678f3bbe16067e76b3f58fdaecdc06fa12e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ffe264d3-cd3a-4cb6-b1ee-af4103b96749.tmp

Filesize
13KB

MD5
ab28c15103829fb8bebc61dc2608ff51

SHA1
c29c2f98ddd631c8fc8d1d888476115fbd47b428

SHA256
eb8013d375de1a2a07680449f821d7f30f1ba01593187936a94ff28acb3f6c4a

SHA512
72d044458d73081366a9b161581af5ba63a10d5a9245b221d5e726843c4f65aebdb15d97c4458e2775784aef098f36e2d2209259260cbff777c4ce84fa786cb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2f2e2306e7fc66bbc3b9a8c93da683d5

SHA1
73ea17ecdd5901003c761750278473e42444f69c

SHA256
7fdc4455a2f9560d3208933dacaa561dc019b88e8b50ded9730454f2af50e179

SHA512
8e62802b7516391d2ea0e099aef06e782369ece8c13fa9698661f1c6bc35d63370846e641cb002b9c49093f8fd3c9eb549ee350e70e4d225c08abcb44139546b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e375af81f5dc8529a33908146cb5a97e

SHA1
44343ab5bd019821e4702809416025cd26ac9eac

SHA256
c435734629381f3e272aafc4aaa515783fbaa9c70c2d0f3af20d72c9df847856

SHA512
90525769203c1aa38591621075debbf21f938800c1271a895c8eaae36935ff668b7e970bae168ec759a96d16938b39470888032ee571fc6edf90f67c62d6bd9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b3d88b8f10e6e9c1c56cb596320e7589

SHA1
944f71fd313c31900ff376f79ddf12127ed89065

SHA256
42936cbca4d61ec07b4ca0b3512e7bb128903351b0f380112dca16f0caf981fb

SHA512
f22c7452dd2131053178d18a3143b215c237c35a211d9b59d33b8133472dbdb24ecc4769896e705abfb8fe1e08192b77f44b37895913ff75e95a7f5df59aa1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
66bc270177e3280494be09577941b750

SHA1
1cc8a3029634e48f604395d2d284edf3fc5fe741

SHA256
babca3e9abd25b7a9f4fa3e29ab3f63d542de18f038946f02defb8238143673a

SHA512
ee13acccfa3969ffc57a3f946658e59d7aafc80719ff2e232a5285816bb16624799e8f6f9e569195e1813fc4c13a817ffbc354cfa6455deb60911265da244c9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b421ec7802f1d9d4594347789ff8faf0

SHA1
aee3f553f0a9c6738ef811084d18c5fba61b51a2

SHA256
792eccbd4b2b5993e99bb61c089c4659c121831408e918fabc1d4fb0c210c14c

SHA512
56239eddf73117464e0a32a371e0b4254ed498638288991e076f3f233480f23cf6509609046de4550a3d4585d7043f0e5081e3221ce109749130a8abc60b00a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
54d4582cc375a08616ee3b3728abc61b

SHA1
46d54bab3fc62ac52b59ae98bdeeff1fb8541898

SHA256
10e4ba8281bb75e2f0169e65a47d247503e0cf6e87a355d2b9d125b2a7fdab54

SHA512
62a95855b59b2f09d1a6d90ca194b7118a460d3f86b38c189bc1c87e36e3cf4a661f052917ddbbd393984ba479bd8c04ed0b9db4ab428e681d382fc5329f8182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5990d3da85c17692ead3f90ca22d5306

SHA1
b2bd9261148349e6e927b8be27eb0a92362e581c

SHA256
920e6488041339725182f4db518b988195040474c53012f454d3c09d87f1abd2

SHA512
0f9e647e6f133b300831b37fb98ade97e54d4597db35d8838b8cdf749e1b23a7e1dbcff51021310bf14b9bdbe7b920dbb4eac07e2656e4dc956c60844f593fa8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b8bf98550142a3f7fdc9555e02a7706d

SHA1
4af0093c6147f79a12aee560d2c69b02bdaff914

SHA256
b1346bb1ba8ff50ea32e50c352158428154123a87091f21345328503ce6fdce6

SHA512
6250ef21d7804537c1da6d6cb8cd8100b9a9ac72332ae16617d751e66d2df8f4de6d93faf21a9178addc209bbc0942fe8670291d00a6cf1d0329c7823d6a1bca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
416262d3dfc94f183504fda64dbdfde2

SHA1
2a5fe75212e4a623d8db9a84dbb8568e3bb6bc24

SHA256
57d052eb7d7cf1180b35ec05ec803b816cd4a66a2462d0d08607582f4daac027

SHA512
2681ff5ac3bcb85a57fcb95859517abc236075167629e6283354e0d1c447715cf1aa9bcecfb1905cf339152f65157010a6678aff7b157319f018a048c3559bd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
47866dafb89410d53e40a3a9b9bca2e2

SHA1
a64242d3519ef46c302ca6f30691db3da0b02447

SHA256
1ee18061531551fc45b866faae7e0443d90d8d681d5cac4c7e0d8d8c3402a52f

SHA512
54dd723f37f834242c20dbd890654a7be1cafc535561bcffe119613ff50f42700456d85a9d9c263b37ae28c4d2802972a276eafd25d3ceff63324e863598cc81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e4eca4479667910306663bb16015aec1

SHA1
a84b2d6d65029feb46d309d839438dbed143f97a

SHA256
b7d33cea5d9c9b53fd35e0c015d9ad1e987c1632486653feedc3ace9c5540d02

SHA512
bed2686b3bcba83a8a2cf38ba41a97502f8bcb6f861c0b38cb7f6c37d9674e034838bc75393778ee855e7ef18e005fdcb7e833f9ca4580120d173ca51763e828

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
cf4f3ef7e1da6956200b3de7db208c6f

SHA1
2767ae46f3f5936bd346dc7d35cd98752c782682

SHA256
2f884a3bf2ea9cb811dbb430733e67d34789a10a811c550b10437a992a39cdf9

SHA512
f0584e52018816c60337446cabd89fd1039804eda53186380b823ffa6c7f21e0520a04889448058a69fd0740f87bf564d87eb972a2e284eb751a046a6c43c57b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
82dac5ac3d3d469135728c67ed7740ed

SHA1
5c09c8df6a11796d5936daa096acca589f012d55

SHA256
37d48f20a6bb00a292ba7c95c704ca726041b090da6caf664c85797d3bc2238f

SHA512
71df4a5f2b8c621bff21f0515df008edbebbc26d7c93ef8f4d0a07e9d8372e69435fc1a805cc33144b5c7af1ae870fa29388fdacbf2780df1e61a7e37f73c1b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
981eacd441c60ffcbed4e282bb4cd6c6

SHA1
1567bc9a8e1b776a0ee375097d7b97a39086902b

SHA256
bebaa47501897377df26a8a1ac8c51fc7fb97161893ed0190336ce87bf8b7452

SHA512
f81e10e7bbcd628ffced5df08c82ded8486cc658dfb8888203643d958b68bb90eefa8fa9584d66d411b4b4ec48ed0028d456a89333a57032b5c8e4dfd3e58916

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
a7a4d8feb554711f982b5ab199fc6447

SHA1
c857989d79c93820e1dc39f4dc6464c078d882c9

SHA256
80800dbe2e44172895aa9524c86c83d447fdc204a0385b18158a4560c39956c9

SHA512
40cd3173bb72f941b2189e37724a23791c030358fc3e63457ba904e01ff9d0004036c8b1ea4586aaaca15e7057f348bf40efe9807f17be47679f1db7c2d9325b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
2c055a8405272da883dca7dac2a8cb7e

SHA1
735a9453c73188435aa63756908571c38e76edd9

SHA256
57a7cc3005ea48e7d4c8aa43365390fd3b2eec02a0417b766cdc581300573542

SHA512
60b30f83cf37852052efad7418cb862ab36234f9a8b544ea04f60dc9ec5ef89e87b222ef1d27e45a2e5ae8306b2b5dce9d12f08dacd4b9a4d7d0044bbd51fe39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
6ffe3358128e83276a2c6e523bfb9518

SHA1
37b2fd145c871e3ef218c6cfe13fe24bb3fbade6

SHA256
0499532ff2535b3f2c2563a9826951f1ea3a572c04aa9ef1a458f6d48b977895

SHA512
6da6c6e6631e30831a6bac104bb5ded4467d5cbcc3bbcc26b3a1f39133b9d3314a2753234a1f45eb89dbb798f759460514405f88f244c88aa97580154848077a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
87019686b1ed0ad0d02bb956cb132a3a

SHA1
234a42feeea8dbf116976f1f2b9124d14b41ca2d

SHA256
9ffd745f34c28dfdcd140e5240c944c8961b7a55a297295d88e4767389af2998

SHA512
d7dc588b80fc512462f1217518bea0bb976776c5d4f544918a9bbc24ad81246baa62dbc0d9f234b79f85c041d8dd6ba09411ad54115e5a00f0ec73a2a1bf43de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
68e42d8b5fc42dc6ab856d6b1d4b2f08

SHA1
adbc0524d31fd719266c6caa07765ea5ddfeec1c

SHA256
23768f05f88fd2ef90cf8512a6718e0d14b8b93aaa6e437b2b26c86523dc4306

SHA512
c9d20c314e45468410c612e20b34c25b14794096fa67b0b60435d88e6bbe654d5ee33511a2a7304be85ba657f8cb988081de02b18ebf11a88319250b5085a631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
20c99bd690c33ca68ccba41f7e5c7297

SHA1
863d67a8e0281cd50cac5cf870cd619929d8e041

SHA256
7dfdd168eddf1e51302bf02888261d856ffee726077d58444c8e18cde9be3b6a

SHA512
18c73e956dc3401fc1aff5d73fb8c842f7093a26925a4b90a5388037580d16e63a26d27a9cf3a05b382e70c3b6b155b810dadbc8777cefbe16ac0af02a50d2ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
704b1b65cc0aa14961b771115e7c89e7

SHA1
a1fc6cbf756a48e0a7d5b3b3395f12fb0872256e

SHA256
527ec5a937a677b1e7cebe8657a8c8d8db9b42c5e6a758e38383463a8e310f93

SHA512
06feb0a706af1d920d4c199564d0c751b7a4a7505a0e9f889d03820638eae77f6d784dd41d4ccc8da41a6e63d0c9cff37b9ce575308d8f9d350c504b38dbd3fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
05e26a5d012b73ea69f65f80f9a32cf8

SHA1
8772220fe9b654d69767491104520c926bcc927d

SHA256
fe1f0fcedef039de7a638ad7e75a60027b29781371df70065d26243a81e8d441

SHA512
84e03fa4632775d975717a4b892b165538249fe27f6b9e320eb09b838a67a314e3d7b506bf88437d3fc68c28acd8c1ce81905119c887e891db76803281aa0b34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
18f6ef8923df0128a64523c0cb14e2b5

SHA1
fc76f7e34887595bc1a6eaac0b1865d669466073

SHA256
d5dddfad073d79adc8cb4d0fa5cc18e4bdf316fb6234a5d4576d6330970dafde

SHA512
4ddf4ef6d5d200ffb8a94d882d58a06e8a11a6e8954e079cab0c8d5ebc18ae7e8d6ea97adcab9ef9ed8a86b915eeb21708975c9a2dbb41c73f0bb36ef14593eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
5b3dd9b891853ed9b20aadc77adb27a4

SHA1
8fd185986dc3f2c8795a7c5abb211186525252d2

SHA256
32e01ba5ba879fc88276284970912f0bac673381b20709179c7fa4c34522f58b

SHA512
537620c43b075306cc643bfcdbdb63ed6829f866ff3872c285b9a8e1ac6552cea7e9d5e2bf76167cd0ddd5527b5048c56a02887d9cf21d0fb883d644109c8e00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
edaf6166a0f28bf8e7fec26661bd3ec0

SHA1
a935c7be057f85cff1a1d04bf64a7886df18c671

SHA256
4e581ed6cace680f668706c9b723f6f40157ddbea0692041baa45f4ec72bad07

SHA512
31a63545ea313063b46a3adba59d8982f36d977ed1d21f91535c77121f9b08c977809dffdcd11ad1753d66383e40836e9dcf1957ec35df5d7035c226d1969328

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5ae83e.TMP

Filesize
93KB

MD5
dbfd8628ddf931d13535856d9a30eb91

SHA1
18e408bbba17a1159fc5d1bc3aa07758c2db6b0a

SHA256
52240de5dbbcfebe920b4a04ed912b9635df24edb4c1723a2efadaae6589a272

SHA512
d8d84f220f152e49f3b1e0f27c1d5f066c0757a606b00de45f216a141a30304f78b2d40dddeb0e2237ee6d387a470905c1c61243f0c9623921d4e7dab241d90c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3E9A.tmp

Filesize
2.1MB

MD5
aad400febadfc1a26acf93570e2e90ef

SHA1
b25a9718931b46037f8e38ca1940900bce16c155

SHA256
beac7e30f0609512fc646ff1dcdc143e8810f71084508426daea6741e4201f67

SHA512
15fb5f408fe72ad27fddc459e0df859c6e360ec6afbacd5872e7df38471ebcc8df62d641c8756971820cd630c778ed61f3f4508e11e0c21070c5e26552db7dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5C65.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI71B3.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3caks0w.0yi.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
224B

MD5
e66d36cbcfd69fdf8db6e5c649137ef1

SHA1
c1ce08cca33347fe58f95f78f61c31ac6501f511

SHA256
15376656ff62df570727bcac73caf451fbe0599729bb4bf648b5e65b3e97f5f4

SHA512
78a8c44885ce2f1a035a3075a50027d6eff5c1adbc4d4d134880b1aced5e5d0f70fb6ca8cb037327ec4890a392b3be84eb85c72f38d4cfac985afab64b7c81bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
9KB

MD5
2ab97e62df5aa08bdbd38426b08467f6

SHA1
d142090abae438a9413f07de1e13d437b60b6486

SHA256
26e11af505c4d2e7ca3aaf19db9ec39726bbbbdfbe1919f07263e5f6b9ae0437

SHA512
75431a42a46ddc5a6d07aa62cd693efa79ab4ab821371ce7672e6dd000e1447328671444ff089aa440241c01c08730b99ff845b6455cee3075ce3e8d9005af21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
11KB

MD5
63a2cc8d9dd248b7617d96665574a82b

SHA1
a42d91e4200fb86f8f6e844c86b99e19a8508854

SHA256
2e4d6ba9f08f78798571d7d8f309b9f962a6c39d83a039f752da32c37e211530

SHA512
a5cfbc63c1d117529d1b889df44c4d1a87ab5a2afa9461185eae88cfdffeb40ef6353c3b45137b1c24bdaded6349ef40b575b83c445a398f60bf5551893394cf

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\Windows\Installer\MSI31D7.tmp

Filesize
154KB

MD5
b2e2c24ebce4f188cf28b9e1470227f5

SHA1
9de61721326d8e88636f9633aa37fcb885a4babe

SHA256
233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69

SHA512
343ea590c7f6b682b3b3e27fd4ab10ffeded788c08000c6dd1e796203f07bf9f8c65d64e9d4b17ce0da8eb17aaf1bd09c002359a89a7e5ab09cf2cb2960e7354

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
241KB

MD5
c7912e2e8e966e63a1e5f8c4ab6e9fa6

SHA1
14cf88f4940bc13a79512afb767bd86d8699f35c

SHA256
4bb120041c5a7bfef7bb4a4048f9f31250cbce3b19328be75784de235e0d8248

SHA512
bc8dfe4eebd75b0eb1325e0cc8ec3ba0e203d8179ce2e6b46211e506d69154ef8c7b5b6689844cc218bd766fa2242de008524047101ca3eeac2cf10ed65612c8

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
26.0MB

MD5
dfcce62f420757a33f285316e5a918ae

SHA1
f9446b931ed84b1e076a4ed194aed486312789dd

SHA256
577f0175bedfb7073a034cccaf864e7b116e5cce55e64cc80e2702ef96a61cdd

SHA512
30ddc2e9748236ddc288868d7710e8f2ace0d1d07e921605edd5c3ef5663ca99c376de73bad3c22023a4acc76071f47e604358f62f67457d4b09f4ec789acd97

Download Submit
\??\Volume{34d48da6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{611f73ce-81e9-4b8f-b8d3-1063dcbbf564}_OnDiskSnapshotProp

Filesize
5KB

MD5
a51261721d7923cfbba6c56765c12c78

SHA1
2de979a9cbd3cae9b81b1406c3860caa054731c3

SHA256
c63d32a23226542d52e472743adab970fd4df3cd1a1c4989102cbbe1370125f2

SHA512
6a631b00c656b6f0c52e57d2e9550c892e0ac90c4af756eea693722b1f882cf23b8a5b84a006f4c1b1b8da6b54730ae777a48a2e678fc7e82b1765b74969ac4f

Download Submit
memory/496-3390-0x000002ABC5420000-0x000002ABC5430000-memory.dmp

Filesize
64KB

Download
memory/4332-189-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-193-0x00007FF7C6B00000-0x00007FF7C6B10000-memory.dmp

Filesize
64KB

Download
memory/4332-440-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-441-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-187-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-188-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-190-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-442-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-439-0x00007FF7CA560000-0x00007FF7CA570000-memory.dmp

Filesize
64KB

Download
memory/4332-194-0x00007FF7C6B00000-0x00007FF7C6B10000-memory.dmp

Filesize
64KB

Download
memory/4452-2817-0x000002522E0D0000-0x000002522E0E0000-memory.dmp

Filesize
64KB

Download
memory/4452-2816-0x000002522E0D0000-0x000002522E0E0000-memory.dmp

Filesize
64KB

Download
memory/4452-2796-0x000002522E0D0000-0x000002522E0E0000-memory.dmp

Filesize
64KB

Download
memory/4452-2797-0x000002522E0D0000-0x000002522E0E0000-memory.dmp

Filesize
64KB

Download
memory/4452-2795-0x000002522E0D0000-0x000002522E0E0000-memory.dmp

Filesize
64KB

Download
memory/4484-2814-0x000001DA54230000-0x000001DA54240000-memory.dmp

Filesize
64KB

Download
memory/4484-2802-0x000001DA54230000-0x000001DA54240000-memory.dmp

Filesize
64KB

Download
memory/4484-2801-0x000001DA54230000-0x000001DA54240000-memory.dmp

Filesize
64KB

Download
memory/4484-2800-0x000001DA54230000-0x000001DA54240000-memory.dmp

Filesize
64KB

Download
memory/4484-2813-0x000001DA54230000-0x000001DA54240000-memory.dmp

Filesize
64KB

Download
memory/4704-170-0x00007FFFFC690000-0x00007FFFFC6A1000-memory.dmp

Filesize
68KB

Download
memory/4704-157-0x00007FF8015F0000-0x00007FF801607000-memory.dmp

Filesize
92KB

Download
memory/4704-153-0x00007FF610A70000-0x00007FF610B68000-memory.dmp

Filesize
992KB

Download
memory/4704-154-0x00007FF802600000-0x00007FF802634000-memory.dmp

Filesize
208KB

Download
memory/4704-158-0x00007FF8015D0000-0x00007FF8015E1000-memory.dmp

Filesize
68KB

Download
memory/4704-162-0x00007FFFFDF70000-0x00007FFFFDF81000-memory.dmp

Filesize
68KB

Download
memory/4704-161-0x00007FFFFDF90000-0x00007FFFFDFAD000-memory.dmp

Filesize
116KB

Download
memory/4704-160-0x00007FFFFDFB0000-0x00007FFFFDFC1000-memory.dmp

Filesize
68KB

Download
memory/4704-159-0x00007FFFFEC60000-0x00007FFFFEC77000-memory.dmp

Filesize
92KB

Download
memory/4704-155-0x00007FFFED7C0000-0x00007FFFEDA76000-memory.dmp

Filesize
2.7MB

Download
memory/4704-156-0x00007FF801670000-0x00007FF801688000-memory.dmp

Filesize
96KB

Download
memory/4704-163-0x00007FFFED5B0000-0x00007FFFED7BB000-memory.dmp

Filesize
2.0MB

Download
memory/4704-166-0x00007FFFFDF40000-0x00007FFFFDF61000-memory.dmp

Filesize
132KB

Download
memory/4704-171-0x00007FFFFC250000-0x00007FFFFC26B000-memory.dmp

Filesize
108KB

Download
memory/4704-186-0x00007FFFEA4D0000-0x00007FFFEB580000-memory.dmp

Filesize
16.7MB

Download
memory/4704-183-0x00007FF610A70000-0x00007FF610B68000-memory.dmp

Filesize
992KB

Download
memory/4704-184-0x00007FF802600000-0x00007FF802634000-memory.dmp

Filesize
208KB

Download
memory/4704-185-0x00007FFFED7C0000-0x00007FFFEDA76000-memory.dmp

Filesize
2.7MB

Download
memory/4704-164-0x00007FFFEA4D0000-0x00007FFFEB580000-memory.dmp

Filesize
16.7MB

Download
memory/4704-165-0x00007FFFFC780000-0x00007FFFFC7C1000-memory.dmp

Filesize
260KB

Download
memory/4704-167-0x00007FFFFC900000-0x00007FFFFC918000-memory.dmp

Filesize
96KB

Download
memory/4704-168-0x00007FFFFC760000-0x00007FFFFC771000-memory.dmp

Filesize
68KB

Download
memory/4704-169-0x00007FFFFC6B0000-0x00007FFFFC6C1000-memory.dmp

Filesize
68KB

Download
memory/4704-172-0x00007FFFED2B0000-0x00007FFFED46A000-memory.dmp

Filesize
1.7MB

Download
memory/5388-2865-0x0000017BBF6C0000-0x0000017BBF6D0000-memory.dmp

Filesize
64KB

Download
memory/5388-2892-0x0000017BBF6C0000-0x0000017BBF6D0000-memory.dmp

Filesize
64KB

Download
memory/5388-2893-0x0000017BBF6C0000-0x0000017BBF6D0000-memory.dmp

Filesize
64KB

Download
memory/5388-2867-0x0000017BBF6C0000-0x0000017BBF6D0000-memory.dmp

Filesize
64KB

Download
memory/5388-2866-0x0000017BBF6C0000-0x0000017BBF6D0000-memory.dmp

Filesize
64KB

Download
memory/6064-1793-0x000001F663040000-0x000001F663062000-memory.dmp

Filesize
136KB

Download
memory/6064-1852-0x000001F663900000-0x000001F663AC2000-memory.dmp

Filesize
1.8MB

Download
memory/6064-1840-0x000001F6636B0000-0x000001F663726000-memory.dmp

Filesize
472KB

Download
memory/6064-1829-0x000001F6635F0000-0x000001F66362C000-memory.dmp

Filesize
240KB

Download
memory/6140-2890-0x0000024926490000-0x00000249264A0000-memory.dmp

Filesize
64KB

Download
memory/6140-2875-0x0000024926490000-0x00000249264A0000-memory.dmp

Filesize
64KB

Download
memory/6140-2877-0x0000024926490000-0x00000249264A0000-memory.dmp

Filesize
64KB

Download
memory/6140-2876-0x0000024926490000-0x00000249264A0000-memory.dmp

Filesize
64KB

Download
memory/6140-2891-0x0000024926490000-0x00000249264A0000-memory.dmp

Filesize
64KB

Download