Overview

overview

8

Static

static

1

71ee99413a...94.vbs

windows10-2004-x64

8

71ee99413a...94.vbs

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/03/2026, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    71ee99413acc62afd6249a71f3f92394.vbs
  • Size 2KB
  • Sample260308-hydllscz8v
  • SHA256 2c2597aa2a1c69d26cf426ce1b13aa0292f570607b93d6ace05cfb999d101fbd
  • MD5 SHA1 SHA512 TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Detects GoToResolve remote administration tool 1 IoCs

    GoToResolve is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 54 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 34 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71ee99413acc62afd6249a71f3f92394.vbs"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://files.catbox.moe/cu4yv6.pdf
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x330,0x7ffbc900c188,0x7ffbc900c194,0x7ffbc900c1a0
        3⤵
          PID:2036
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,6066544294281683961,17228732787986090509,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
          3⤵
          • System Time Discovery
          PID:400
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,16521574614533290248,5370692317894870458,262144 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
          3⤵
            PID:3276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,7663784732758088801,7392713521384363385,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
            3⤵
              PID:4416
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,5314572099022246576,2512567291504536740,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
              3⤵
                PID:380
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,14291037640322719335,15592057480995607940,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                3⤵
                  PID:2172
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,16633899633965597260,410286434727444676,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
                  3⤵
                    PID:3372
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,511864458891411254,1070543822920264530,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
                    3⤵
                      PID:1904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,12401305369210421193,15010750667475292947,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
                      3⤵
                        PID:752
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4396,i,16495595612090863941,1612257685926707675,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
                        3⤵
                          PID:3668
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7428507471272415069,12707627338932703687,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
                          3⤵
                            PID:3376
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5484,i,3966152912850004863,11208501736257217928,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:9
                            3⤵
                              PID:4852
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4248,i,10569334374434266416,17442888559446676485,2097152 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:15
                              3⤵
                                PID:4496
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,9690434030404969257,8910238079619368583,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
                                3⤵
                                  PID:3892
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2264968953550164867,13767900891432446515,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
                                  3⤵
                                    PID:1796
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7966892065259095983,15979252085801001529,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                    3⤵
                                      PID:4820
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7966892065259095983,15979252085801001529,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                      3⤵
                                        PID:3160
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,14378003100991914742,15888815010059683538,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3952
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                          cookie_exporter.exe --cookie-json=1132
                                          4⤵
                                            PID:4452
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,3144511036851588628,12279731266969966268,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                          3⤵
                                            PID:1920
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,2268987902546018868,1200443717666167659,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
                                            3⤵
                                              PID:3036
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1731556684715664587,501723297067964180,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
                                              3⤵
                                                PID:4544
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,12468294927667260055,17846250503981790716,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
                                                3⤵
                                                  PID:2892
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,15227414559884647700,9415562420879261962,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
                                                  3⤵
                                                    PID:4688
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,9589105664970900211,1693866395707673660,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
                                                    3⤵
                                                      PID:4544
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,13993901106882305859,9169505721365012008,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
                                                      3⤵
                                                        PID:1692
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7671187094410935573,4546247120261421032,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
                                                        3⤵
                                                          PID:1920
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,8184061031142233347,9158663190346618190,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
                                                          3⤵
                                                            PID:4812
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12600242371834661725,1275119382045976107,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                                            3⤵
                                                              PID:6740
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4432,i,17603142624248689280,12039436581546065054,262144 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:10
                                                              3⤵
                                                                PID:2452
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,4818866876081429423,12268895678627036128,524288 --field-trial-handle=2108,i,12175494458161971973,128731518513165539,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
                                                                3⤵
                                                                  PID:2736
                                                              • C:\Windows\System32\msiexec.exe
                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\installer.msi" /qn
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1920
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:588
                                                              • C:\Windows\system32\msiexec.exe
                                                                C:\Windows\system32\msiexec.exe /V
                                                                1⤵
                                                                • Badlisted process makes network request
                                                                • Enumerates connected drives
                                                                • Drops file in Windows directory
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3524
                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 44E23F1BE8B193B0B62445BEFB0844EC
                                                                  2⤵
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3036
                                                                • C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
                                                                  "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer.msi" "-MsiInstanceGuid" "{6F923F04-FB58-4346-85A8-7B1DC182AFF0}" "-MsiUiLevel" "2"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2296
                                                                  • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveUnattended.exe
                                                                    "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer.msi" "-MsiInstanceGuid" "{6F923F04-FB58-4346-85A8-7B1DC182AFF0}" "-MsiUiLevel" "2" "-installerFileName" "installer.msi"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks system information in the registry
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Checks processor information in registry
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5096
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveProcessChecker.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 5096 -InstallationId UKAl7csKX5 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164" -ApplicationType 4 -Environment "Production" -ForceInstall 0
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Checks processor information in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:2976
                                                                  • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveTools64.exe
                                                                    "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveTools64.exe" -InstallVDD
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks system information in the registry
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Checks processor information in registry
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3628
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=847890a370d4601b4208ca0b0b16c58d --annotation=format=minidump --annotation=hostname=Crrtojjn --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodulehandler.json" --initial-client-data=0x340,0x344,0x348,0x338,0x34c,0x7ff70e04f8a8,0x7ff70e04f8c0,0x7ff70e04f8d8
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4376
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:768
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout /T 3
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Delays execution with timeout.exe
                                                                      PID:2580
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4952
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\x64\g2rvdd.inf" "9" "433a66683" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\x64"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:4244
                                                              • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveProcessChecker.exe
                                                                "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164" -ApplicationType "4"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks system information in the registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Checks processor information in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4632
                                                                • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe
                                                                  "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=2830469938610873164 --annotation=component=Unattended --annotation=computerid=847890a370d4601b4208ca0b0b16c58d --annotation=format=minidump --annotation=hostname=Crrtojjn --annotation=installationid=UKAl7csKX5 --annotation=platform=win --annotation=version=1.31.1.908 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodulehandler.json" --initial-client-data=0x7c4,0x7c8,0x7cc,0x730,0x7d0,0x70b02b90,0x70b02ba0,0x70b02bb0
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:4344
                                                                • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveUnattended.exe
                                                                  "C:/Program Files (x86)/GoTo Resolve Unattended/2830469938610873164/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "4632" "-InstallationId" "UKAl7csKX5" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_2830469938610873164" "-Service" "-LogLevel" "2" "-CrashHandlerPipe" "\\.\pipe\crashpad_4632_XUOHLKYKAEZJUQZJ"
                                                                  2⤵
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks system information in the registry
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Checks SCSI registry key(s)
                                                                  • Checks processor information in registry
                                                                  • Modifies data under HKEY_USERS
                                                                  • Modifies registry class
                                                                  • Modifies system certificate store
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2580
                                                                  • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveLoggerProcess.exe
                                                                    GoToResolveLoggerProcess.exe -ParentProcessId 2580 -CompanyId 2830469938610873164 -InstallationId UKAl7csKX5 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164" -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_4632_XUOHLKYKAEZJUQZJ -HostId 847890a370d4601b4208ca0b0b16c58d -LogLevel 2 -SessionType Unattended
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:3128
                                                                  • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveExternalModuleHandler.exe
                                                                    "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveExternalModuleHandler.exe" -InstallationId UKAl7csKX5 -CompanyId 2830469938610873164 -publickey a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f -LogLevel 2 -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_4632_XUOHLKYKAEZJUQZJ
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Program Files directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2028
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\IataModule\0.137.4\GoTo.Resolve.Iata.App.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\IataModule\0.137.4\GoTo.Resolve.Iata.App.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\IataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:5400
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\DeviceDataModule\1.274.0\GoTo.Resolve.DeviceData.App.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\DeviceDataModule\1.274.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • Modifies data under HKEY_USERS
                                                                      • Modifies system certificate store
                                                                      PID:5496
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\BcdrModule\1.2025.1216.2\GoTo.Resolve.Bcdr.App.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\BcdrModule\1.2025.1216.2\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:5916
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AlertsModule\1.2026.0209.0\GoTo.Resolve.Alerts.Monitor.App.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AlertsModule\1.2026.0209.0\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:5884
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\1.2026.0303.01\GoTo.Resolve.Antivirus.App.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\1.2026.0303.01\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Drops file in System32 directory
                                                                      PID:6060
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\1.2026.0219.05\GoTo.Resolve.PatchManagement.Client.exe
                                                                      "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\1.2026.0219.05\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • Drops file in Windows directory
                                                                      PID:5780
                                                                      • C:\Windows\SYSTEM32\where.exe
                                                                        "where" -r "C:\Program Files\WindowsApps" Winget.exe
                                                                        5⤵
                                                                          PID:5656
                                                                        • C:\Windows\SYSTEM32\where.exe
                                                                          "where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe
                                                                          5⤵
                                                                            PID:6256
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"
                                                                            5⤵
                                                                            • Drops file in System32 directory
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:6280
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "Import-Module appx Add-AppxProvisionedPackage -Online -PackagePath C:\Windows\SystemTemp\tmpv5sltb.tmp.msixbundle -SkipLicense"
                                                                            5⤵
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Windows directory
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:6560
                                                                            • C:\Windows\TEMP\EC97A0A9-9473-44C2-8AEC-CF7CAFF233F9\dismhost.exe
                                                                              C:\Windows\TEMP\EC97A0A9-9473-44C2-8AEC-CF7CAFF233F9\dismhost.exe {761DC03A-B5EA-439D-B10E-F4415187F2C8}
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              PID:6400
                                                                        • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
                                                                          "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          PID:4616
                                                                        • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\EdrModule\1.2026.0205.12\GoTo.Resolve.Edr.Client.exe
                                                                          "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\EdrModule\1.2026.0205.12\GoTo.Resolve.Edr.Client.exe" --Credentials:CompanyId 2830469938610873164 --Credentials:HostId syn-eu-adb-unattended-46ff18d1-e8ee-4764-af16-f2dd0afc6918 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\EdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\token.txt" --ZeroTrust:ReferencePublicKeyHash a170954a74e0e86cb1e654aaa7155dc173c5c8249cb464e6fdff7bf5bd7d0d5f --Native:Version 1.31.1.908
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:3132
                                                                      • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveNetworkChecker.exe
                                                                        GoToResolveNetworkChecker.exe -BaseUrl https://devices-iot-eu.console.gotoresolve.com/ -SessionBackendUrl https://sessions-eu.console.gotoresolve.com -WebsiteUrl devices-iot-eu.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId UKAl7csKX5 -CompanyId 2830469938610873164 -Environment Production -CrashHandlerPipe \\.\pipe\crashpad_4632_XUOHLKYKAEZJUQZJ
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:1640
                                                                    • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveUnattendedUi.exe
                                                                      "C:/Program Files (x86)/GoTo Resolve Unattended/2830469938610873164/GoToResolveUnattendedUi.exe" "-CompanyId" "2830469938610873164" "-InstallationId" "UKAl7csKX5" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164" "-Environment" "Production" "-ApplicationType" "4" "-CrashHandlerPipe" "\\.\pipe\crashpad_4632_XUOHLKYKAEZJUQZJ" "-Lang" "en" "-WebsiteUrl" "devices-iot-eu.console.gotoresolve.com"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:2716
                                                                      • C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe
                                                                        "C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=2830469938610873164 --annotation=component=Unattended --annotation=format=minidump --annotation=hostname=Crrtojjn --annotation=installationid=UKAl7csKX5 --annotation=platform=win --annotation=version=1.31.1.908 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\appdata\externalmodulehandler.json" --initial-client-data=0x834,0x838,0x83c,0x7dc,0x840,0x70b02b90,0x70b02ba0,0x70b02bb0
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:3960
                                                                  • C:\Windows\system32\sc.exe
                                                                    C:\Windows\system32\sc.exe
                                                                    1⤵
                                                                    • Launches sc.exe
                                                                    PID:2452
                                                                  • C:\Windows\system32\sc.exe
                                                                    C:\Windows\system32\sc.exe start GoToResolve_2830469938610873164
                                                                    1⤵
                                                                    • Launches sc.exe
                                                                    PID:6232
                                                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                                                    1⤵
                                                                      PID:6396
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                                                                      1⤵
                                                                        PID:6876

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            e588c31.rbs
                                                                            • Path C:\Config.Msi\e588c31.rbs
                                                                            • Size 7KB
                                                                            • SHA256 47b0539495f35aa4df05f23ce4a2735e2aa4594a9d71176650b2e8a4f4f28a75
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            g2rvdd.cat
                                                                            • Path C:\PROGRA~2\GOTORE~1\283046~1\x64\g2rvdd.cat
                                                                            • Size 10KB
                                                                            • SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            g2rvdd.dll
                                                                            • Path C:\PROGRA~2\GOTORE~1\283046~1\x64\g2rvdd.dll
                                                                            • Size 141KB
                                                                            • SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            FileManager.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\FileManager.dll
                                                                            • Size 16.2MB
                                                                            • SHA256 b565952f53f07df684dac6ca523d6f03d8bb50785741b9767413feda6cca64b5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoToResolveCrashHandler.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveCrashHandler.exe
                                                                            • Size 642KB
                                                                            • SHA256 c86d46e9ffa827a56f283279647e0515b6d8853b18e2f6d8c56e1a168ab05183
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoToResolveProcessChecker.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveProcessChecker.exe
                                                                            • Size 401KB
                                                                            • SHA256 d3717beedb8cde6e59f63aeae14beb97e0fb930b95b3ac487a36d0a11c5f97ca
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoToResolveTools64.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveTools64.exe
                                                                            • Size 1.3MB
                                                                            • SHA256 a589ad16db7cdf2b527dcd887992c8960b0e62736e3acc6cd53f9bb534d0f929
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoToResolveUnattended.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\GoToResolveUnattended.exe
                                                                            • Size 401KB
                                                                            • SHA256 26e681758f77b953c093460f0d92f98885fe8533c5da92f729f7f4c53377cbdb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            LibGoToResolve.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\LibGoToResolve.dll
                                                                            • Size 19.9MB
                                                                            • SHA256 01c93d48c0752032a7057024e0c229b27200b732e390ee9db807e014003fb076
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            MediaClientLib.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\MediaClientLib.dll
                                                                            • Size 14.0MB
                                                                            • SHA256 7d7cadebd1689b726950b016fe65b1eff60e8c463d73f88e53f749d936fec35d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            PasswordPrivacyDll.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\PasswordPrivacyDll.dll
                                                                            • Size 1.1MB
                                                                            • SHA256 fddae83872e9c6502661cdf8ebb8f78fa1140954a9f071da9395825464436c56
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AlertsModule\1.2026.0209.0\logs\2026-03-08.log
                                                                            • Size 1KB
                                                                            • SHA256 5cc60b3daf0c8332fad1ae201901f303cf0d5e5535efbd840eeb51e3c9a7e03a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AlertsModule\1.2026.0209.0\logs\2026-03-08.log
                                                                            • Size 4KB
                                                                            • SHA256 62b386e8c924488d04d1f0d96dbc3ca47b4b234a04ddc465fc2acfbbdae82a65
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoTo.Resolve.Antivirus.App.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\1.2026.0303.01\GoTo.Resolve.Antivirus.App.exe
                                                                            • Size 158KB
                                                                            • SHA256 6c6c2384ec02e52ec2eef648297fe458d520f6dbb72dec54a1ead09cea13cbf4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\appdata\logs\2026-03-08.log
                                                                            • Size 2KB
                                                                            • SHA256 859890f874a49369cff080e95edaa89139b93fa578b8e511d8e8aa48f173d9f2
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\appdata\logs\2026-03-08.log
                                                                            • Size 2KB
                                                                            • SHA256 438bf83d4e86c83f3669bd0b3fe7f24da91a7c56e5ba1e4fb540e1337765e99b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\AntivirusModule\appdata\logs\2026-03-08.log
                                                                            • Size 7KB
                                                                            • SHA256 d82d3e09542194b2e4342178f47931bd01a6b56fbf43680a4d04f38785495069
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoTo.Resolve.Bcdr.App.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\BcdrModule\1.2025.1216.2\GoTo.Resolve.Bcdr.App.exe
                                                                            • Size 26.3MB
                                                                            • SHA256 b56625c601aa3cec37cce2e11b2b77ea933c2678931f9ed8c2dbd2a541d26a55
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoTo.Resolve.DeviceData.App.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\DeviceDataModule\1.274.0\GoTo.Resolve.DeviceData.App.exe
                                                                            • Size 23.3MB
                                                                            • SHA256 5cd0f5ec06211ba749244130e6cbc11f2fbc02c7938cd4092c56637add806eff
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoTo.Resolve.Edr.Client.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\EdrModule\1.2026.0205.12\GoTo.Resolve.Edr.Client.exe
                                                                            • Size 158KB
                                                                            • SHA256 949c72188a06a0414586f75dd07e9128968600a2f0f482df40a16b850ec15cbe
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            GoTo.Resolve.Iata.App.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\IataModule\0.137.4\GoTo.Resolve.Iata.App.exe
                                                                            • Size 4.6MB
                                                                            • SHA256 e7225bf2adce0520890c91a6100a4d6e896703a00b9b8a235a75c8a50c69e575
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\1.2026.0219.05\logs\2026-03-08.log
                                                                            • Size 1KB
                                                                            • SHA256 39a7d301eaa66dece40149292f913e215776a714245fff870808d624af28ff27
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\1.2026.0219.05\logs\2026-03-08.log
                                                                            • Size 4KB
                                                                            • SHA256 098f79b452c22636dd88233b8beb7c2622e4a12ee72d5cdc5fadcb478b960a78
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            2026-03-08.log
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\PatchManagementModule\1.2026.0219.05\logs\2026-03-08.log
                                                                            • Size 6KB
                                                                            • SHA256 b92ab981c6f4b6b7c1c56009819ca002294fd292fb3dfe8cc53ab30b3c1e1009
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            RemoteExecution.Runner.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
                                                                            • Size 157KB
                                                                            • SHA256 658562be436234a6c39b6f3d022aa62b6c94c83c323e52bf96541a012f403d07
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            mscordaccore_amd64_amd64_8.0.1925.36514.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\externalmodules\RemoteExecutionModule\1.2025.0827.1\mscordaccore_amd64_amd64_8.0.1925.36514.dll
                                                                            • Size 1.3MB
                                                                            • SHA256 c05d685863850917187b7282aa9739b23d5b967cac411c1fbe122b13a24ce5fa
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            libcrypto-3-x64.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\libcrypto-3-x64.dll
                                                                            • Size 5.8MB
                                                                            • SHA256 e1d46a1d7dee171550055e2a485306c99aca982a99d4c02fcdcda20eb21b336b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            libcrypto-3.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\libcrypto-3.dll
                                                                            • Size 4.2MB
                                                                            • SHA256 6ce2cd3a63de4cd1cfb34f8f73ea84de27ca0dfcfa0a52289fe1c40058311573
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            libssl-3.dll
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\libssl-3.dll
                                                                            • Size 1.1MB
                                                                            • SHA256 400ebc0a146849023b3ce86686b17f12e8cbbcbacf8b78de70a0ea6eb2781bf9
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            unattended.json
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\unattended.json
                                                                            • Size 1KB
                                                                            • SHA256 635221cc3bd36be6f019e7424a13f1a783eacc22616484b3982483d520804104
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            unattended.json
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\unattended.json
                                                                            • Size 703B
                                                                            • SHA256 69b8c1f36300a1a3f96100497c30b5e502efd4626d5c1aeed224f777de69b565
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            unattended.json
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\unattended.json
                                                                            • Size 804B
                                                                            • SHA256 8332d8c30ec98488430c307ce8cc5dbcb5c4afbd427e2c1e15b2bac687612ae8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            g2rvdd.inf
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\2830469938610873164\x64\g2rvdd.inf
                                                                            • Size 3KB
                                                                            • SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            unattended-updater.exe
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
                                                                            • Size 23.4MB
                                                                            • SHA256 1c47ddb0b5e1ba5daccbfa72fffad2f93a658d0370382086f7b841aa654555b0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            unattended-updater.exe.cmd
                                                                            • Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
                                                                            • Size 537B
                                                                            • SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            protocols.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                            • Size 3KB
                                                                            • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 acc64b5fafe18b6dd8318d3036a3f5c8aba723aef062fb3fcb70757f1fe28095
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 393d76a3d1e0981fb8c79e8fbf067ec2567826241ea874a8dcc210e4131d3f45
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            63997d07-543c-409d-aa20-b6b0f909ceaf.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63997d07-543c-409d-aa20-b6b0f909ceaf.tmp
                                                                            • Size 14KB
                                                                            • SHA256 9b6019932f377db740e967fd7a2b9a958cce3c1aafb713e397daeacccbcc8633
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 3KB
                                                                            • SHA256 9c521d2a124987726a039dfeebf006dc08084d3ab2d2ad1b684318ec28425faf
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe58afa4.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58afa4.TMP
                                                                            • Size 3KB
                                                                            • SHA256 0225266612edffe1846531f8863878d2d44f20e40a71aa183a4fd2291c70cd27
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SiteList-Enterprise.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                            • Size 2B
                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Edge Profile.ico
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                            • Size 70KB
                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 2KB
                                                                            • SHA256 ea2f0a2a91e224e0ee7f822035853ed18ff3871e1819f6041fb314ac0a46cf88
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 111B
                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SCT Auditing Pending Reports
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 15KB
                                                                            • SHA256 07de994c86aa1ab91a239ed50fa490dbf0a928880be35dc197fbfbce4429cb5c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                            • Size 36KB
                                                                            • SHA256 126af947a5f32f3ac5358e18102fdc6fbfbee00d30c783f8d704431b9e7cb03b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            sync_diagnostic.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                            • Size 4KB
                                                                            • SHA256 33a222071305880ccd9145825d014ed5c349275f0df4dca4c6bfec7ac8c10730
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            9462106c-85bf-46c9-8534-4c93dc2dda23.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9462106c-85bf-46c9-8534-4c93dc2dda23.tmp
                                                                            • Size 22KB
                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 18KB
                                                                            • SHA256 7963e78070143ac4ecc574bd6b0b59dac21c2b453dafb663759f8b9d94d73ff5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 a89ef7b21831391ac0cd2c70c80ae490b085fff86b5c73eecf75ee07b70fcdb6
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 18KB
                                                                            • SHA256 2737c03854f7ed74289a45e775c9780eaa19beb92a51b821b159494168bc53e8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 6e5bc8b84f13d9a8c660e000ad55b160f466fb20e42d107b21a019479b393b63
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 28KB
                                                                            • SHA256 83975c6907591b764638a56ed90a744d2cb1af2436e4ef28ba252686828a5674
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 18KB
                                                                            • SHA256 f5846359691d7c3a434b1ce8284b68b8e01f5ed10bc3d3a791d0799e169d4ba1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                            • Size 132B
                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                            • Size 13B
                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            1c7762d1-1c04-4b07-b0a0-e1538839621b.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\1c7762d1-1c04-4b07-b0a0-e1538839621b.tmp
                                                                            • Size 10KB
                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            4dd0933e-d1f6-4183-af5d-975e280f14d8.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\4dd0933e-d1f6-4183-af5d-975e280f14d8.tmp
                                                                            • Size 1B
                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            installer.msi
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\installer.msi
                                                                            • Size 23.4MB
                                                                            • SHA256 3616751d1ca964c289ee086686c9cd1042dde76c3ff731fd7a010084d3b940c7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            content_new.js
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_581426063\CRX_INSTALL\content_new.js
                                                                            • Size 10KB
                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            d8ad371a-8545-46f9-9ac2-fce794789d8a.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_921378726\d8ad371a-8545-46f9-9ac2-fce794789d8a.tmp
                                                                            • Size 146KB
                                                                            • SHA256 31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            MSI9025.tmp
                                                                            • Path C:\Windows\Installer\MSI9025.tmp
                                                                            • Size 825KB
                                                                            • SHA256 d3d2c268fee70b2514c4f66d889c80654f463e0a762a75823771cd978c058b5a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            dism.log
                                                                            • Path C:\Windows\Logs\DISM\dism.log
                                                                            • Size 289KB
                                                                            • SHA256 c7d3ee058d516de604e4c8153a7d97c12f993216ef2f117cabded9924368b7a0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                            • Size 727B
                                                                            • SHA256 3b07cc764a65a01be96a4827c7d7e0c005867df163226976ff903bb5a560b14f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
                                                                            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
                                                                            • Size 727B
                                                                            • SHA256 2064385eb3d07930a0c27b563156fdee7705cec73e7b6348a3388dce16d0c791
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                            • Size 400B
                                                                            • SHA256 c93ab8663e7b4b8d6c55d3979882b04e749454293e9b80d9cf1fa16bb8db70ef
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
                                                                            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
                                                                            • Size 408B
                                                                            • SHA256 12f61cf2673090a5144d7b98a29c91ae99b143b798b444e74938f3ae80652590
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            3ysfq0ih.00f
                                                                            • Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\8ba8c6c77280bb692671c5c5fe4a1b810806e95a9c0e23c7deaef648e85644be\3ysfq0ih.00f
                                                                            • Size 1B
                                                                            • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            manifest.json
                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_2097374026\manifest.json
                                                                            • Size 43B
                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            manifest.json
                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_396553819\manifest.json
                                                                            • Size 135B
                                                                            • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            __PSScriptPolicyTest_azevdwqu.zkt.ps1
                                                                            • Path C:\Windows\Temp\__PSScriptPolicyTest_azevdwqu.zkt.ps1
                                                                            • Size 60B
                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            memory/1640-899-0x0000000004910000-0x000000000491E000-memory.dmp
                                                                            Download

                                                                            memory/1640-894-0x0000000002D40000-0x0000000002E3E000-memory.dmp
                                                                            Download

                                                                            memory/1640-895-0x0000000002E80000-0x0000000002E8B000-memory.dmp
                                                                            Download

                                                                            memory/1640-896-0x00000000038C0000-0x00000000038D0000-memory.dmp
                                                                            Download

                                                                            memory/1640-897-0x00000000038D0000-0x00000000038E2000-memory.dmp
                                                                            Download

                                                                            memory/1640-898-0x0000000003910000-0x0000000003918000-memory.dmp
                                                                            Download

                                                                            memory/1920-655-0x000001D86F070000-0x000001D86F15A000-memory.dmp
                                                                            Download

                                                                            memory/2028-950-0x00000000040E0000-0x00000000040E8000-memory.dmp
                                                                            Download

                                                                            memory/2028-890-0x0000000002AC0000-0x0000000002BBE000-memory.dmp
                                                                            Download

                                                                            memory/2028-891-0x0000000002BF0000-0x0000000002BFB000-memory.dmp
                                                                            Download

                                                                            memory/2028-951-0x0000000004790000-0x000000000479E000-memory.dmp
                                                                            Download

                                                                            memory/2028-893-0x0000000003930000-0x0000000003942000-memory.dmp
                                                                            Download

                                                                            memory/2028-892-0x0000000003920000-0x0000000003930000-memory.dmp
                                                                            Download

                                                                            memory/2028-3615-0x0000000002AC0000-0x0000000002BBE000-memory.dmp
                                                                            Download

                                                                            memory/2296-637-0x0000000002F50000-0x000000000304E000-memory.dmp
                                                                            Download

                                                                            memory/2580-3540-0x0000000002710000-0x000000000280E000-memory.dmp
                                                                            Download

                                                                            memory/2580-878-0x0000000002980000-0x0000000002990000-memory.dmp
                                                                            Download

                                                                            memory/2580-876-0x0000000002710000-0x000000000280E000-memory.dmp
                                                                            Download

                                                                            memory/2580-880-0x0000000003AB0000-0x0000000003AB8000-memory.dmp
                                                                            Download

                                                                            memory/2580-879-0x0000000002990000-0x00000000029A2000-memory.dmp
                                                                            Download

                                                                            memory/2580-881-0x0000000004020000-0x000000000402E000-memory.dmp
                                                                            Download

                                                                            memory/2580-877-0x0000000000AB0000-0x0000000000ABB000-memory.dmp
                                                                            Download

                                                                            memory/2716-914-0x00000000036E0000-0x00000000036E8000-memory.dmp
                                                                            Download

                                                                            memory/2716-917-0x0000000003E20000-0x0000000003E2E000-memory.dmp
                                                                            Download

                                                                            memory/2716-916-0x0000000003C90000-0x0000000003CA2000-memory.dmp
                                                                            Download

                                                                            memory/2716-913-0x0000000002A90000-0x0000000002A9B000-memory.dmp
                                                                            Download

                                                                            memory/2716-915-0x0000000003930000-0x0000000003940000-memory.dmp
                                                                            Download

                                                                            memory/2716-912-0x0000000002AB0000-0x0000000002BAE000-memory.dmp
                                                                            Download

                                                                            memory/2976-798-0x0000000001570000-0x000000000157B000-memory.dmp
                                                                            Download

                                                                            memory/2976-797-0x0000000003200000-0x00000000032FE000-memory.dmp
                                                                            Download

                                                                            memory/2976-800-0x0000000003DE0000-0x0000000003DF2000-memory.dmp
                                                                            Download

                                                                            memory/2976-799-0x0000000003B70000-0x0000000003B80000-memory.dmp
                                                                            Download

                                                                            memory/3128-885-0x0000000001490000-0x000000000149B000-memory.dmp
                                                                            Download

                                                                            memory/3128-886-0x0000000003CD0000-0x0000000003CE0000-memory.dmp
                                                                            Download

                                                                            memory/3128-888-0x0000000004670000-0x000000000467E000-memory.dmp
                                                                            Download

                                                                            memory/3128-887-0x0000000003F30000-0x0000000003F42000-memory.dmp
                                                                            Download

                                                                            memory/3128-889-0x0000000004680000-0x0000000004688000-memory.dmp
                                                                            Download

                                                                            memory/3128-884-0x0000000002FE0000-0x00000000030DE000-memory.dmp
                                                                            Download

                                                                            memory/3160-509-0x0000012459200000-0x00000124592EA000-memory.dmp
                                                                            Download

                                                                            memory/3524-727-0x0000020978F60000-0x000002097904A000-memory.dmp
                                                                            Download

                                                                            memory/3524-726-0x0000020978D60000-0x0000020978D6C000-memory.dmp
                                                                            Download

                                                                            memory/3628-716-0x000001BA68060000-0x000001BA6814A000-memory.dmp
                                                                            Download

                                                                            memory/4244-712-0x0000029FE0EB0000-0x0000029FE0EBC000-memory.dmp
                                                                            Download

                                                                            memory/4452-159-0x000002907C4E0000-0x000002907C5CA000-memory.dmp
                                                                            Download

                                                                            memory/4632-873-0x00000000023E0000-0x00000000023F0000-memory.dmp
                                                                            Download

                                                                            memory/4632-875-0x0000000002900000-0x000000000290E000-memory.dmp
                                                                            Download

                                                                            memory/4632-871-0x0000000001650000-0x000000000174E000-memory.dmp
                                                                            Download

                                                                            memory/4632-3526-0x0000000001650000-0x000000000174E000-memory.dmp
                                                                            Download

                                                                            memory/4632-874-0x00000000023F0000-0x0000000002402000-memory.dmp
                                                                            Download

                                                                            memory/4632-872-0x00000000015F0000-0x00000000015FB000-memory.dmp
                                                                            Download

                                                                            memory/5096-791-0x0000000003AE0000-0x0000000003AF0000-memory.dmp
                                                                            Download

                                                                            memory/5096-793-0x0000000003B10000-0x0000000003B1E000-memory.dmp
                                                                            Download

                                                                            memory/5096-792-0x0000000003AF0000-0x0000000003B02000-memory.dmp
                                                                            Download

                                                                            memory/5096-789-0x0000000003090000-0x000000000318E000-memory.dmp
                                                                            Download

                                                                            memory/5096-802-0x0000000003090000-0x000000000318E000-memory.dmp
                                                                            Download

                                                                            memory/5096-803-0x0000000001590000-0x000000000159B000-memory.dmp
                                                                            Download

                                                                            memory/5096-804-0x0000000003AE0000-0x0000000003AF0000-memory.dmp
                                                                            Download

                                                                            memory/5096-790-0x0000000001590000-0x000000000159B000-memory.dmp
                                                                            Download

                                                                            memory/5096-794-0x0000000004DB0000-0x0000000004DB8000-memory.dmp
                                                                            Download

                                                                            memory/5096-806-0x0000000003B10000-0x0000000003B1E000-memory.dmp
                                                                            Download

                                                                            memory/5100-470-0x0000017FC74C0000-0x0000017FC74CC000-memory.dmp
                                                                            Download

                                                                            memory/5100-471-0x0000017FC92F0000-0x0000017FC93DA000-memory.dmp
                                                                            Download

                                                                            memory/5100-516-0x0000017FC92F0000-0x0000017FC93DA000-memory.dmp
                                                                            Download

                                                                            memory/5100-515-0x0000017FC74C0000-0x0000017FC74CC000-memory.dmp
                                                                            Download

                                                                            memory/6280-3807-0x00000228FE740000-0x00000228FE762000-memory.dmp
                                                                            Download

                                                                            memory/6560-3839-0x000001C01D3C0000-0x000001C01D3E6000-memory.dmp
                                                                            Download

                                                                            memory/6560-3838-0x000001C01D360000-0x000001C01D36A000-memory.dmp
                                                                            Download

                                                                            memory/6560-3837-0x000001C01D890000-0x000001C01D943000-memory.dmp
                                                                            Download

                                                                            memory/6560-3836-0x000001C01D370000-0x000001C01D38C000-memory.dmp
                                                                            Download

                                                                            memory/6560-3829-0x000001C01D330000-0x000001C01D34C000-memory.dmp
                                                                            Download