asyncrat | 6e7ff182d4509ea804b6ed739ffa2191af2891af164ede9a90e79aea8fee4d1f

Resubmissions

12/03/2025, 21:58

250312-1vyfqat1dx 10

12/03/2025, 21:51

250312-1qnqqawkv6 10

12/03/2025, 21:45

250312-1mkjwstzcv 10

Analysis

max time kernel
347s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Report.ps1
Size

458KB
MD5

20d2c488f9ce3e337faf20ea1a9abe47
SHA1

ea844520e903e1f7d8f234a057cd3cc778380ae9
SHA256

6e7ff182d4509ea804b6ed739ffa2191af2891af164ede9a90e79aea8fee4d1f
SHA512

6581df037579fd6684ee4a44d2e631a4aa9c524b47c47fe2afb9434c487824146fb000d9c7a7b63df6c534b00f4a979f24be88019b3ed12d9bf3ce81508b243c
SSDEEP

768:llcMsNARzF0NToMotYJKN2C0FIMG9Kl/2:6/2

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

A 14

Botnet

Default

nams.ddnsfree.com:409

aliomar.ooguy.com:409

Mutex

MaterxMutex_Egypt409

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 4524	4936	powershell.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4936	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133862899207550723"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000011149fdf4c81db01a024890b9993db01b5878b0b9993db0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4524	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4936	powershell.exe
4936	powershell.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
3948	chrome.exe
3948	chrome.exe
4872	taskmgr.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4872	taskmgr.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe
4524	aspnet_compiler.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5764	chrome.exe
4872	taskmgr.exe
5588	chrome.exe
4524	aspnet_compiler.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4872	taskmgr.exe
Token: SeSystemProfilePrivilege	4872	taskmgr.exe
Token: SeCreateGlobalPrivilege	4872	taskmgr.exe
Token: SeDebugPrivilege	4524	aspnet_compiler.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe
Token: SeCreatePagefilePrivilege	3948	chrome.exe
Token: SeShutdownPrivilege	3948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
4872	taskmgr.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
4872	taskmgr.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
3948	chrome.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4524	aspnet_compiler.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5588	chrome.exe
5588	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4524	4936	powershell.exe	94
PID 4936 wrote to memory of 4736	4936	powershell.exe	95
PID 4936 wrote to memory of 4736	4936	powershell.exe	95
PID 3948 wrote to memory of 4952	3948	chrome.exe	118
PID 3948 wrote to memory of 4952	3948	chrome.exe	118
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 1428	3948	chrome.exe	119
PID 3948 wrote to memory of 5052	3948	chrome.exe	120
PID 3948 wrote to memory of 5052	3948	chrome.exe	120
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121
PID 3948 wrote to memory of 3056	3948	chrome.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Report.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4524
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn administrator
  2⤵
  PID:4736

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0x94,0x124,0x7ffec38dcc40,0x7ffec38dcc4c,0x7ffec38dcc58
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4624,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4628,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4640,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4508,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4852,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5172,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5024,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5224,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5392,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3204,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3488,i,3276304504091349826,6133539978316323203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5588

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d7415d9b1092b036261022accd1f8ce9

SHA1
d31a51e4755be741ae779b94257600b77b5db239

SHA256
4367dcf29fd463be9fd8ad38c4adbd946bb3288d6e0e794d82468cc747176458

SHA512
073f53f09184bd37f4ccdd7e7043a1373678a11e9d0b15957d22989a5f514bc28d963b13963325542466faf28b004ddb873df7944e8d787814f90ec8735cdc30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
168B

MD5
852622d39ea930227db8b78ad51f7083

SHA1
e6cdc5b54d07ae86e06e134448bf8bd9b5e67c2b

SHA256
6a02812be22b445951193b3365ceab396c296f2ad1dd71467be1dbf0a917b7ac

SHA512
f952f5356cdb3109221e20ac896a21f941185f818176f5a3b76b6ace9752de5d711439c0988a629e57ec8aebaedcf9e8c82c3b9dd540d8d13bfd133656156223

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c38e79580cfeff6dd9dde93b7fda541f

SHA1
4b7fc122034d4419987072e6e4635823cfc044ea

SHA256
6dd828ecab51b254fae9f1e5bd2e0783fbac983da88456a48495621d701cc5aa

SHA512
3082b448ad811f4a0309ec83985ed8e7e07362f79817b18fee18702843f14412914f6ec2328038a961b8b526336cc1d6ae373e7954affc3cb66a93009469f76c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
8aba74a6c8ba88cb63b355e2f95e5522

SHA1
cc6869a83b62efefe11fcac51a924ccc5bca7e3b

SHA256
7fe091b003918de2873a55f01c9f91dabb42bed33f66975fdca50bdf169b378a

SHA512
06c8cf8a0f7d4fa16a315cca8ecb888050140538320125c968a77c987b0fc410a67bf15638feb8c1a667cf239d6aea4ac9d7c68fbeb92ef8eed812839dbb407b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7e80b0306f0a760bdd69b9b71c027855

SHA1
d54d2d06805805f57699d6776078175067cd541c

SHA256
7e057beee65d44e921bff427d039b39b2d901c398041b18baee382b03fa1b78e

SHA512
7a428f5e6199f7eac7641f3fa234ea702746d5e7bdde963f439450763fd661ac06ef413a2687856a2447dd98be1f60c53abbc7b89d58dcbbd577a8557f347950

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6e316ded0d084f3f8cb539aaf1b8a4cb

SHA1
383d3547de82d6b364d26a2a92636e86acc56b55

SHA256
1628ec7cf1f598e09b1a17ca0f057d2f865ff7c01f9fac37453a702dfbcc87e8

SHA512
5f78fe95548efcc0d58facd29a0e7d06695dff9f932ba77b7dcbb09f91887e98311dd765743e20c3b9bff61ecbbc0acb8880b2fa9b0a7e2bd2ca568e3f8f1623

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba789cad09fa760833b13af0494d8c1c

SHA1
1b645583dfaf307925468cd6c694ff2f213a4cae

SHA256
701769a26f2b704ee19ee1a51a4f0e4a179e85889c9701cf5282f218b4adef38

SHA512
2315b0d0c01b176b8ccad544f7adfd0c539a10383d57a3b5520a78704246865282213ad4663e7716423416e7c6cff7d6b6441d64b315950bb1bf44b1fde67cb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c250eebf3e60fbeff3cde08b971583c6

SHA1
900a39007b9b25cea625ff84c32cbf0fba252d13

SHA256
bb5017b54c3ffc34b18a9d035cff3d40723460a8093a9ea956fc4bf0cdd4da72

SHA512
471b0e997cd978049f275369da9aa4f6e6cc22d8543734b961389dea403c7e9c06695dc857799bf0c9b22738af509845ac727db84bde452fe06e21efa802f329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e4ca6735eeafb2803207ccc1a141647c

SHA1
0e09ea7cab5ea6d575063a2f2335f20edf370eaa

SHA256
1eea57b3425127354baba85f9b144b472b8c89b38c97877f5759af8d641e1f5b

SHA512
d44fec2797e8a2a7c2a26e4193a78ac5d23e14fb648cb86cac42eae1925001d6a82c4f3183376e288693d37a99c633beca2eb4175d4d6774ab5a50a961fce940

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
163d223870a98338c257b16a3a0f467d

SHA1
fd6faeff879208918a08deed7b627fd54ae13120

SHA256
2350314ef0caaa9bf79ef86ddae5814fdfa714a14273f44a244f50f56de52f18

SHA512
7e887691b6af072529bd3a5af185cc1bd254d369a3a86cfc1437d53d88376f6581cfa92c8c8872128b46cc8ded434cf9f0335442406176c36e4177e3e7f96dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0ed81bdcf2afae9caa4a4172ad52e2f8

SHA1
01e2c81d7e9746628a5610e2ed0041bc800b5760

SHA256
0fe5285108a188385b7b49eab78ca95ee1dbb95e5e71ad4255d6df1a36b8bf50

SHA512
850ae9c73c6739a3dc1b6e13679b4491567010f9bb25dce720ff7c8a4b94e85dbf6b25af6a4ed9a09a2b954532ec13236e39773cdf806103d5422db2dfd01960

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
65981ff14bc05aab33efd16128159700

SHA1
44f7d7d04d5c0a0a06eee3998d6d5d69fcb33251

SHA256
c9e7a1bc5282bc99d772b0181c27d697bf6feac3d2b946dad3b679b9e82ac990

SHA512
86874ea24f0ddb0e9018dda66d94abac702fb97af9d39f756472144c62d8f0a6a4a2b5298b584e2e514f0bf77ed1249a28415cc520e52ba7f759b58b6cfecaa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f58b1c56ec3d9e6c17806f06b72a18d2

SHA1
6e0c71caec05f3958ecfe1948c681cfbe553108f

SHA256
5f2891179b02636cc9755a7de9d710bc70fa9dbe8c9dd19de46d895f0506750a

SHA512
bd6f30982d96479d76cea5f6523eaefaa523cf8a4b96d40d41a90d7bf0a88e76cf682d785096036ae2cc0a5322ec1aed095fed5d77ce9dffb47775f15647d2fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4fb93c3a51d2eae0cf04c2c2250ee944

SHA1
5a97d70ad47d5c6ee80382b066806d0b546668b8

SHA256
41b5ce02e38819ba3e9f54cb5257ba9f199c5e9e9784f75b91a4b0a2e735e69e

SHA512
3e603f5e8415f47458f0e34d94d4cedcbc35ec278e1a65e93674a658674eba6f0d7ec8e91864797350c5abe789f3b9d7e563f5e779c1fc9b941520d9c9395f71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
67cbcef808b35108d127a6d3a310495f

SHA1
03f512290e137482fc22661c69951f2a7e64e3a1

SHA256
1eed3037f293e4f8d35114ccca37e1652240616b4d2d5476eb397a2e245882cb

SHA512
2f6f91be92deae068e6658e88350e089c5a06944529661ef4f42bd53d1d1d617627a23a10e57a462c2083b69be4b96f54727cadc74d95a1642cc524459e9338a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
660d1833a70d8426a224cd863a5914e2

SHA1
1b04382dd56ad3e20034b4beaa0edb4e50c26f7e

SHA256
ab090cfb19bbf1b60fd4f913c5c501685a29721cc9883642956ac2bc40c10a34

SHA512
2a308b095762ccf7cbb128bb1ddde646126eb5cb5ab673d6872d3bbf69ce67120edfca20ba8cbbedaef5493833061620a9d8b07cb2c90cad9ae6184f890f8df5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3b3e6a0fecad6f685ef5a827348e310

SHA1
141baed12bef87dcc0422b9799ddd1add9bcbb97

SHA256
086a747e7d974c1174a05330b5d818d4a9864ac9d0558d0992c95a617df00767

SHA512
94c8a2d91fed820f2458e3b87350e2711721a17782b3ea722bf98ec819eb2f485353aa408a5f29b8c5745e71a2cdc2d7dc0ea50f9ea3e310ed003bd81dcac7e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ac36f14f5e8899666a509dfe9a08e997

SHA1
d5b6ad49c7e467d0ccce3de94307358519597bb6

SHA256
15c537d3f6f08d067fab6bdb9e06aee649157b370309639407aefb015e83bf02

SHA512
b0faf5a04d69d6121848a721c53d9f9957cb94a563bbac56915634ef93f22b8613f2232f05a55775349a8fa7a3c098a063940bcb52c6da1a57a541404ca747a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
16c3af8b2bf42aae962985be4178fa16

SHA1
07557d7b066858040f7bebaee31496e3bbd9c8e4

SHA256
bf5cf4e22acf86bc71e847709071615a23204db2d1bfdef9a2dc70101b26bf5b

SHA512
ae70dba39076d0327b8b7db08c41d9f5ebd45475f4c18e6a8b0f22764874b7d8de8cfb67b0e075f679f43f4b8ae4063f00ae712a3bf81974bc9dcca59b36f35d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f03b2fe58b8a2c2ad57f24bfe0e5b7e

SHA1
90add49edcc4db9328d24d72787c847f54e4acbb

SHA256
790fe49dd024778f85ee7b54e72f1473ee447db62d5e2f5fbe5903d066fa3554

SHA512
ff5e06a467ead70bcb1aa0e591c76e0b04ea5870180e4bd40335e62651b4da6dca222a019556f2af54db0402bed331561c1b49fa33a1e1524ec877df4a88e825

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0e80cc37f319e576c75e8910fb0272ee

SHA1
27f325dcd8213cb15848de6bd84970a24061b3ec

SHA256
2d02401d372d5948f5c841c7ee29566ef95fe5e366e06ca403d7ae73a0587ef8

SHA512
5018f5b47767c1f55b8d810aac3744f8d6697414392214a7b2c5268edc5d595fa903a579c11df9dfd004f39b7d86ee3d5142f1f988491d1720d6285f6df6d5d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a5bdb48d9ff222ef482a230e9c2f5330

SHA1
e29226dbb8d403ab0982c1fe5e3aa180af450a24

SHA256
ab3cd11f84ab10490019d816cac609a31d4351e6c26728a43d7c012a670f863c

SHA512
e580d971627aeb86a6510a2b2107e315c4be707d29139a4ad0aead9e641a1c8bbf9a47249c0b175ac80c1247e4764e5bad7117b64e21791257ac4cf3c7d5f4f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f4a0701947dae7f773ff9c5b4434df7

SHA1
6c596a9d5e1e1a5796414db6b92533251950eb85

SHA256
58163959196034c076f4936fcec5d425a4f8bcb6196f30e686706cfeadf35092

SHA512
9197e8d45016beecf7ea9a30234c896c94fba07941a566f843e9cc7da4db23d73a821c6785f88fbee411e554f281a6fe6643bd24a4b4de549cc8bb521f17b376

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
167d414f79ed254a192efa075582973d

SHA1
95e8e3b195598b0e8a061141270f2dc0cf6c92c9

SHA256
e7ed1c6af9fa5a76f489f35d0e58f0ebedef195809e59f0c9a1942094c9fabbb

SHA512
84c3af51314e2c594675ac8c8ac36f16dcc336746ff32ef7e1078eca3d61850af3dda8c80a897f8fb4e928d72f2da5a3bd294f9185eb8c9ff9e95da5bfa23299

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
dbec6a59bf819cc11ae3ce806b75bc12

SHA1
c39e5cef093e927f835c92aa2860c4610b89fc22

SHA256
0c054bf3d1812de536dbb314a49821714e861cff5841da7b65ffecf76d783955

SHA512
6a122418bb954ee8d64bb3bb9f53a7aa1977defc36bb517acc891f33018383268d9b9485554b5a4ce6a586f02fbd47d7c2cceb0420249e971a6874c0d46a1d68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
79a62e2ceb01e9352a72056db2aa0bf6

SHA1
3f26d21a7663809f13502d7a0b96fc194df3d2ac

SHA256
d6e576899e292a435ba8f486e79b967a2042f00f0b94fe22cf3b13ad294cab85

SHA512
f9ad683d0d76775d89728d0e88d181db9c099a2cd602ac925cd6f82d58bf0cc86f49ddb4007d4dcd24fbc71ff45b6aa47b9f41b6f021566c66bd1ba5595215df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
514a860d4118c98b0f365bdd96443651

SHA1
a6fe5a643609404c384f3764d11ac7319183a631

SHA256
d6e740e756bf4095a0964702f951b540845c9945e4806f930134515d5cd407c3

SHA512
e9d3b6959abb0bf9a2a48c7ff62a6c80ff3fe767b321ec09eb3fe7fc12b1a8629c2bf76c97e26c7ed7d8529deacfb9507779f2630596ac45966a0e60bdac532d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
3f88572975c79285e719c5f16a21e77b

SHA1
f5eee70ce558ecbc877ad9e05a62ce43ece84383

SHA256
0d500966a786acbce7acf6871fcb8dd264af6d5c29cb027f3ed8805156ea3708

SHA512
598f49bb2c5a9d9ca663562b41dbbe46a6e03c79de48a183857d15a54771f76fdf0abe3ec45696b7a9fbbaec855ce6653242dd36e090afc1ea3197fc5ba736b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rbvfzko2.aqu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_1303436446\0bbb9ec7-3349-4d2d-a2da-7d61e77f747e.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_1303436446\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\Downloads\aspnet_compiler.exe

Filesize
55KB

MD5
fda8c8f2a4e100afb14c13dfcbcab2d2

SHA1
19dfd86294c4a525ba21c6af77681b2a9bbecb55

SHA256
99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09

SHA512
94f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18

Download Submit
memory/4524-42-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/4524-41-0x00000000752FE000-0x00000000752FF000-memory.dmp

Filesize
4KB

Download
memory/4524-40-0x0000000006D70000-0x0000000006DD6000-memory.dmp

Filesize
408KB

Download
memory/4524-39-0x0000000006CD0000-0x0000000006D6C000-memory.dmp

Filesize
624KB

Download
memory/4524-36-0x0000000005990000-0x000000000599A000-memory.dmp

Filesize
40KB

Download
memory/4524-35-0x0000000005700000-0x0000000005792000-memory.dmp

Filesize
584KB

Download
memory/4524-34-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/4524-33-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/4524-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4524-15-0x00000000752FE000-0x00000000752FF000-memory.dmp

Filesize
4KB

Download
memory/4872-29-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-27-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-30-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-31-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-32-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-21-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-22-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-20-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-26-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4872-28-0x00000215A6C60000-0x00000215A6C61000-memory.dmp

Filesize
4KB

Download
memory/4936-16-0x0000014461D60000-0x0000014461D70000-memory.dmp

Filesize
64KB

Download
memory/4936-19-0x00007FFEC2BE0000-0x00007FFEC36A1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-13-0x000001447C490000-0x000001447C49A000-memory.dmp

Filesize
40KB

Download
memory/4936-0-0x00007FFEC2BE3000-0x00007FFEC2BE5000-memory.dmp

Filesize
8KB

Download
memory/4936-12-0x00007FFEC2BE0000-0x00007FFEC36A1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-11-0x00007FFEC2BE0000-0x00007FFEC36A1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-8-0x000001447C620000-0x000001447C642000-memory.dmp

Filesize
136KB

Download