9dca68b0accb0d32505b06af57ffcd53a29e304542237d121c952a311bc9f816

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
Size 33.3MB
Sample260701-mtds2aes5w
SHA256 9dca68b0accb0d32505b06af57ffcd53a29e304542237d121c952a311bc9f816
MD5 0a86dc72fffe3ecbbedb378726fb51e8
SHA1 9d1bda1e3886f81fab737483def742e09151c927
SHA512 44019d710635d0c236e46a00996c2049bae094d8babfcd81f84d3b38ae22c0b0728383b951c19d6176fe5c00c2e32bdd43358558d66f970a6d7e7cd5d80def25
SSDEEP 786432:L/w5SmsbC7tz5otY2O9azBtWhMkrJHTnF79TPuLlAiZ:L4wmf7EtPPzHWhFrJHh79yLfZ
TLSH
T103773338D479B500CA5B6CF231FD23550DA3895E26BCC27F89B89371BAB4587A379C60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
5736	FluxOpenHardwareMonitor.exe
1408	OpenHardwareMonitorLib.sys
4248	FluxOpenHardwareMonitor.exe
5044	FluxOpenHardwareMonitor.exe
5976	FluxOpenHardwareMonitor.exe
1224	FluxOpenHardwareMonitor.exe
3800	FluxOpenHardwareMonitor.exe
5760	FluxOpenHardwareMonitor.exe
4828	FluxOpenHardwareMonitor.exe
2104	FluxOpenHardwareMonitor.exe
1036	FluxOpenHardwareMonitor.exe
2824	FluxOpenHardwareMonitor.exe
1944	FluxOpenHardwareMonitor.exe
1060	FluxOpenHardwareMonitor.exe
4932	FluxOpenHardwareMonitor.exe

Loads dropped DLL 28 IoCs

pid	Process
5736	FluxOpenHardwareMonitor.exe
5736	FluxOpenHardwareMonitor.exe
4248	FluxOpenHardwareMonitor.exe
4248	FluxOpenHardwareMonitor.exe
5044	FluxOpenHardwareMonitor.exe
5044	FluxOpenHardwareMonitor.exe
5976	FluxOpenHardwareMonitor.exe
5976	FluxOpenHardwareMonitor.exe
1224	FluxOpenHardwareMonitor.exe
1224	FluxOpenHardwareMonitor.exe
3800	FluxOpenHardwareMonitor.exe
3800	FluxOpenHardwareMonitor.exe
5760	FluxOpenHardwareMonitor.exe
5760	FluxOpenHardwareMonitor.exe
4828	FluxOpenHardwareMonitor.exe
4828	FluxOpenHardwareMonitor.exe
2104	FluxOpenHardwareMonitor.exe
2104	FluxOpenHardwareMonitor.exe
1036	FluxOpenHardwareMonitor.exe
1036	FluxOpenHardwareMonitor.exe
2824	FluxOpenHardwareMonitor.exe
2824	FluxOpenHardwareMonitor.exe
1944	FluxOpenHardwareMonitor.exe
1944	FluxOpenHardwareMonitor.exe
1060	FluxOpenHardwareMonitor.exe
1060	FluxOpenHardwareMonitor.exe
4932	FluxOpenHardwareMonitor.exe
4932	FluxOpenHardwareMonitor.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1792-10-0x00007FF67FF00000-0x00007FF680F00000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_440325817\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
976	powershell.exe
3172	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FluxOpenHardwareMonitor.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2828	systeminfo.exe
4728	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273763777893001"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{CA9D4A83-0548-464D-B068-821A528CC998}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{36C396A2-C277-4CEC-812E-4C826B6CF31A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{5B57B1CA-5712-4AE8-B45D-4BFCBC1F37CA}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{934F7753-B5CF-44B2-B2B4-FC01F21E1A1E}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5172	powershell.exe
5172	powershell.exe
1204	wmic.exe
1204	wmic.exe
1204	wmic.exe
1204	wmic.exe
976	powershell.exe
976	powershell.exe
2776	dxdiag.exe
2776	dxdiag.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
3008	wmic.exe
3008	wmic.exe
3008	wmic.exe
3008	wmic.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
872	dxdiag.exe
872	dxdiag.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
6112	powershell.exe
6112	powershell.exe
6112	powershell.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	1204	wmic.exe
Token: SeSecurityPrivilege	1204	wmic.exe
Token: SeTakeOwnershipPrivilege	1204	wmic.exe
Token: SeLoadDriverPrivilege	1204	wmic.exe
Token: SeSystemProfilePrivilege	1204	wmic.exe
Token: SeSystemtimePrivilege	1204	wmic.exe
Token: SeProfSingleProcessPrivilege	1204	wmic.exe
Token: SeIncBasePriorityPrivilege	1204	wmic.exe
Token: SeCreatePagefilePrivilege	1204	wmic.exe
Token: SeBackupPrivilege	1204	wmic.exe
Token: SeRestorePrivilege	1204	wmic.exe
Token: SeShutdownPrivilege	1204	wmic.exe
Token: SeDebugPrivilege	1204	wmic.exe
Token: SeSystemEnvironmentPrivilege	1204	wmic.exe
Token: SeRemoteShutdownPrivilege	1204	wmic.exe
Token: SeUndockPrivilege	1204	wmic.exe
Token: SeManageVolumePrivilege	1204	wmic.exe
Token: 33	1204	wmic.exe
Token: 34	1204	wmic.exe
Token: 35	1204	wmic.exe
Token: 36	1204	wmic.exe
Token: SeIncreaseQuotaPrivilege	1204	wmic.exe
Token: SeSecurityPrivilege	1204	wmic.exe
Token: SeTakeOwnershipPrivilege	1204	wmic.exe
Token: SeLoadDriverPrivilege	1204	wmic.exe
Token: SeSystemProfilePrivilege	1204	wmic.exe
Token: SeSystemtimePrivilege	1204	wmic.exe
Token: SeProfSingleProcessPrivilege	1204	wmic.exe
Token: SeIncBasePriorityPrivilege	1204	wmic.exe
Token: SeCreatePagefilePrivilege	1204	wmic.exe
Token: SeBackupPrivilege	1204	wmic.exe
Token: SeRestorePrivilege	1204	wmic.exe
Token: SeShutdownPrivilege	1204	wmic.exe
Token: SeDebugPrivilege	1204	wmic.exe
Token: SeSystemEnvironmentPrivilege	1204	wmic.exe
Token: SeRemoteShutdownPrivilege	1204	wmic.exe
Token: SeUndockPrivilege	1204	wmic.exe
Token: SeManageVolumePrivilege	1204	wmic.exe
Token: 33	1204	wmic.exe
Token: 34	1204	wmic.exe
Token: 35	1204	wmic.exe
Token: 36	1204	wmic.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeIncreaseQuotaPrivilege	976	powershell.exe
Token: SeSecurityPrivilege	976	powershell.exe
Token: SeTakeOwnershipPrivilege	976	powershell.exe
Token: SeLoadDriverPrivilege	976	powershell.exe
Token: SeSystemProfilePrivilege	976	powershell.exe
Token: SeSystemtimePrivilege	976	powershell.exe
Token: SeProfSingleProcessPrivilege	976	powershell.exe
Token: SeIncBasePriorityPrivilege	976	powershell.exe
Token: SeCreatePagefilePrivilege	976	powershell.exe
Token: SeBackupPrivilege	976	powershell.exe
Token: SeRestorePrivilege	976	powershell.exe
Token: SeShutdownPrivilege	976	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeSystemEnvironmentPrivilege	976	powershell.exe
Token: SeRemoteShutdownPrivilege	976	powershell.exe
Token: SeUndockPrivilege	976	powershell.exe
Token: SeManageVolumePrivilege	976	powershell.exe
Token: 33	976	powershell.exe
Token: 34	976	powershell.exe
Token: 35	976	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
6012	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	dxdiag.exe
872	dxdiag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1388	1792	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	88
PID 1388 wrote to memory of 5172	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	89
PID 5172 wrote to memory of 2828	5172	powershell.exe	91
PID 5172 wrote to memory of 5324	5172	powershell.exe	94
PID 1388 wrote to memory of 1204	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	95
PID 1388 wrote to memory of 976	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	98
PID 1388 wrote to memory of 3864	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	100
PID 1388 wrote to memory of 2700	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	106
PID 1388 wrote to memory of 2776	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	110
PID 1388 wrote to memory of 2972	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	113
PID 1388 wrote to memory of 2364	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	115
PID 1388 wrote to memory of 5856	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	117
PID 2972 wrote to memory of 4728	2972	powershell.exe	119
PID 2972 wrote to memory of 5036	2972	powershell.exe	120
PID 1388 wrote to memory of 3008	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	121
PID 1388 wrote to memory of 3172	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	123
PID 1388 wrote to memory of 5736	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	125
PID 1388 wrote to memory of 4668	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	129
PID 1388 wrote to memory of 5076	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	133
PID 1388 wrote to memory of 872	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	153
PID 1388 wrote to memory of 4248	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	137
PID 1388 wrote to memory of 6112	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	139
PID 6112 wrote to memory of 6012	6112	powershell.exe	141
PID 6012 wrote to memory of 2868	6012	msedge.exe	142
PID 6012 wrote to memory of 2452	6012	msedge.exe	144
PID 6012 wrote to memory of 3904	6012	msedge.exe	145
PID 6012 wrote to memory of 3904	6012	msedge.exe	145
PID 6012 wrote to memory of 3904	6012	msedge.exe	145
PID 6012 wrote to memory of 4844	6012	msedge.exe	146
PID 6012 wrote to memory of 4844	6012	msedge.exe	146
PID 6012 wrote to memory of 5400	6012	msedge.exe	147
PID 6012 wrote to memory of 1976	6012	msedge.exe	148
PID 6012 wrote to memory of 5400	6012	msedge.exe	147
PID 6012 wrote to memory of 5400	6012	msedge.exe	147
PID 6012 wrote to memory of 1976	6012	msedge.exe	148
PID 6012 wrote to memory of 1976	6012	msedge.exe	148
PID 6012 wrote to memory of 4688	6012	msedge.exe	149
PID 6012 wrote to memory of 4688	6012	msedge.exe	149
PID 6012 wrote to memory of 4688	6012	msedge.exe	149
PID 6012 wrote to memory of 2828	6012	msedge.exe	185
PID 6012 wrote to memory of 2828	6012	msedge.exe	185
PID 6012 wrote to memory of 2828	6012	msedge.exe	185
PID 6012 wrote to memory of 3856	6012	msedge.exe	151
PID 6012 wrote to memory of 3856	6012	msedge.exe	151
PID 6012 wrote to memory of 872	6012	msedge.exe	153
PID 6012 wrote to memory of 872	6012	msedge.exe	153
PID 6012 wrote to memory of 5536	6012	msedge.exe	154
PID 6012 wrote to memory of 5536	6012	msedge.exe	154
PID 6012 wrote to memory of 2680	6012	msedge.exe	156
PID 6012 wrote to memory of 5920	6012	msedge.exe	157
PID 6012 wrote to memory of 5920	6012	msedge.exe	157
PID 1388 wrote to memory of 5044	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	158
PID 6012 wrote to memory of 2660	6012	msedge.exe	162
PID 6012 wrote to memory of 2660	6012	msedge.exe	162
PID 1388 wrote to memory of 5976	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	163
PID 1388 wrote to memory of 1224	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	165
PID 1388 wrote to memory of 3800	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	167
PID 6012 wrote to memory of 5820	6012	msedge.exe	169
PID 6012 wrote to memory of 6016	6012	msedge.exe	170
PID 6012 wrote to memory of 5248	6012	msedge.exe	171
PID 1388 wrote to memory of 5760	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	172
PID 1388 wrote to memory of 4828	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	174
PID 1388 wrote to memory of 2104	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	176
PID 1388 wrote to memory of 1036	1388	2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_0a86dc72fffe3ecbbedb378726fb51e8_hive.exe
  "fluxcore worker"
  2⤵
  - Enumerates connected drives
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "systeminfo | find \"System \""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Windows\system32\systeminfo.exe
      "C:\Windows\system32\systeminfo.exe"
      4⤵
      Gathers system information
      PID:2828
  - - C:\Windows\system32\find.exe
      "C:\Windows\system32\find.exe" "System "
      4⤵
      PID:5324
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get VirtualizationFirmwareEnabled
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PhysicalDisk | Select-Object BusType, MediaType, FriendlyName | Format-Table -HideTableHeaders"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\system32\diskpart.exe
    diskpart
    3⤵
    PID:3864
- - C:\Windows\system32\diskpart.exe
    diskpart
    3⤵
    PID:2700
- - C:\Windows\system32\dxdiag.exe
    dxdiag /x C:\Users\Admin\AppData\Local\FluxCore\dxdiag.xml
    3⤵
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "systeminfo | find \"System \""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\system32\systeminfo.exe
      "C:\Windows\system32\systeminfo.exe"
      4⤵
      Gathers system information
      PID:4728
  - - C:\Windows\system32\find.exe
      "C:\Windows\system32\find.exe" "System "
      4⤵
      PID:5036
- - C:\Windows\system32\wsl.exe
    wsl.exe systemctl is-active rancher-system-agent.service
    3⤵
    PID:2364
- - C:\Windows\system32\wsl.exe
    wsl.exe systemctl is-active rke2-agent.service
    3⤵
    PID:5856
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get VirtualizationFirmwareEnabled
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PhysicalDisk | Select-Object BusType, MediaType, FriendlyName | Format-Table -HideTableHeaders"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3172
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5736
- - C:\Windows\system32\diskpart.exe
    diskpart
    3⤵
    PID:4668
- - C:\Windows\system32\diskpart.exe
    diskpart
    3⤵
    PID:5076
- - C:\Windows\system32\dxdiag.exe
    dxdiag /x C:\Users\Admin\AppData\Local\FluxCore\dxdiag.xml
    3⤵
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:872
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe start http://127.0.0.1:18180
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:18180/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffad909c188,0x7ffad909c194,0x7ffad909c1a0
        5⤵
        
        PID:2868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,1370275876534773159,1890667060751050692,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,11063987582828236472,3933139230982538681,262144 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
        5⤵
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,12205701805451275130,143034502829371063,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12778890246367895563,5854289649657533312,2097152 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,9733087885603222585,16132102941305292886,2097152 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
        5⤵
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,3712933946693731032,11196037676469757959,2097152 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
        5⤵
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,13192093043098427925,4326634878076656656,2097152 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
        5⤵
        
        PID:2828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,14131921819353058494,3337863192208020117,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14737430272837711421,654316603529221604,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
        5⤵
        
        PID:872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,8969696363835701195,4669485496097722294,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14944361073614922164,10020287001976945694,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
        5⤵
        
        PID:1332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14944361073614922164,10020287001976945694,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4998048376706590984,15379615143743358102,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13498803634212502208,1582951150108947948,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
        5⤵
        
        PID:2660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,14626126857100829446,17956862935803479754,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,11616129744780452537,14684660462480979904,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,2253820272543987710,18033123284280137697,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:14
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,12759343507297419749,17821899370297656085,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1496,i,10842339267555963005,16970180695098292843,524288 --field-trial-handle=2504,i,17897756384980501010,10808120606361655491,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
        5⤵
        
        PID:5732
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5976
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1224
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3800
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5760
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2104
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1036
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2828
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4932

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2256

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1236

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3144

C:\Users\Admin\AppData\Local\FluxCore\OpenHardwareMonitorLib.sys
C:\Users\Admin\AppData\Local\FluxCore\OpenHardwareMonitorLib.sys
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 4d4dfe2d571b2fb692a311daea5ad9fad6e7ee22f716691a05539075e63d33c3
MD5 abae757867b596ce42bea7cb19bb0cf4
SHA1 f5d3c60389e87a8d22eca0bd70cfa481c33961eb
SHA512 637c32f249993ad396d244eb543408215c6d448de296cbeeb623f493fa8dde31f7c0fe9706db56ef39737c5a0e3c022ae90f87f797a1735654845badd2bbfdcc
SSDEEP 3:G9pF/lGlll/l/lXp9ZjrPBY06ll0xe+l1ZP:GLF/0dPBY0Ok
TLSH
T13E5312841192061BC462433008C606403B7412044353485142105130D858B070162194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 960B
SHA256 dae63549d23b9f08ebb27d21f1e35b864f600d844bd96873644805f120bb745d
MD5 6d52438dc0c50ba54aed3c06a2b97cc0
SHA1 e4ccb3fb895dca552d3b4ce71615a07f6087c576
SHA512 d6bc69917fbaa158fe43a628cd628244944ae43b02bbb57af65cf40ecda31bd25ae2280dc08d0f4934898642ce5e8eccfc88bab0475cb72700166a810a6e93c6
TLSH
T178118C543BC72DB0E37A78354029A2101212B10248D2D20885C088624E23204E031FA5
MD5 SHA1 SHA512 TLSH

Submit Download

FluxOpenHardwareMonitor.exe

Path C:\Users\Admin\AppData\Local\FluxCore\FluxOpenHardwareMonitor.exe
Size 12KB
SHA256 530e520e203a93a0751f1f88b8564ee3feec4c837ff6a7a952664c1d1a3884ad
MD5 22bad380998e07bf821a5bcda0350301
SHA1 3108fc8ff6eb7cd57e0496135c798bb1ae8d3f4b
SHA512 3c83a8eba1dda917be78e16aa3ac4303421c545742b37f25dac5dbee875d840eb5b74a6817a25f720306619abec0efc3fc04333950befbef526e953faabb43ae
SSDEEP 96:9eICnj+sqe4GeCo7rpt4BL9O4v1HP8iUlSSSSSSSSIEEiA7S3z2pF2D+ltA4ZJFP:QFSlluD10X4kzKFC0tA4Z/H/n0KfP/
TLSH
T10242D9047BF8C664F57F4738686317241771FA439C11DBAE2E46A18B5E23B404B92FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenHardwareMonitorLib.dll

Path C:\Users\Admin\AppData\Local\FluxCore\OpenHardwareMonitorLib.dll
Size 304KB
SHA256 ef02b0991aac678052bb79dfdfd5bfa0b42b1f34b209e35819ba606909655f58
MD5 84f1d429196cc4e89d22b2652e65f669
SHA1 1872656aafd1e4e3977edee368b05e110a0ead39
SHA512 22e5c3137ca24415946bb3c827a97faef3038db79a21c87d05c195f0debb8727ade37cb4e133779a8e68bc517337962c73d03580a3d9a9ea7a1fddffb671c519
SSDEEP 6144:d9zMSmePubTkkz/iH/2b2vdQh/eHpuCsnca9KQTDBHj:d9oSV8TkH6Cst5
TLSH
T1AA644C5073DC4905F0BFABB5A9B20C059BB1F6E62671DB4F4CA984AD1B633828D43763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenHardwareMonitorLib.sys

Path C:\Users\Admin\AppData\Local\FluxCore\OpenHardwareMonitorLib.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdiag.xml

Path C:\Users\Admin\AppData\Local\FluxCore\dxdiag.xml
Size 170KB
SHA256 a3e5fe36603a9a482a0c98db7499339eaab361175e0d663d25365475a99244af
MD5 d5dd7c512b9715d6eddbbe487d4c1a9e
SHA1 9b6b4bcc51141129603cba6a0537432cc94381ac
SHA512 89009a8e19d3b691e937646191e70491b07ca4fb392d14a7db350398f04a7b245e67393ad0f688d7dbd0b3041131287815e97f5bd41fe7d4c16b21ca206a6557
SSDEEP 768:kiJvSMGcRAVAzpJYY5onWWMdnZ07VFev+aX5L6ja5F/1I0+WtGuhdrrkNEr+aL/K:oJY5onWln2ZF0+aXRUa5Fy0dFLi
TLSH
T16604BC1839159920E00DB89EF8623F3F5A5CB56BE8C6482971BFCECB198BD1AD704F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdiag.xml

Path C:\Users\Admin\AppData\Local\FluxCore\dxdiag.xml
Size 170KB
SHA256 929bffe5d7b3c0329328dd331e1a41a6baba38845c711078faf07ebcf0eb9a20
MD5 1aa445c41e9a11ba64829baa416f988a
SHA1 e172f373f255e17a72e861f8082b4186f78178f4
SHA512 5ed151c0566bd4814c86615e5927a5dfe71c936968d7c9ebe8a070e536683da5d044770286484d7c57e985a2124f1786e2b2fdf9486cfbdc7514e62b852204af
SSDEEP 768:5iJvSMGcRAVAzpJYY5onWWMdnZ0/VFev+aX5L6ja5F/1I0+WtGuhdrrkNEr+aL/K:vJY5onWln2NF0+aXRUa5Fy0dFLi
TLSH
T16304BC1839159920E00DB89EF8623F3F5A5CB56BE8C6482971BFCECB198BD1AD704F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fluxcore_rsa

Path C:\Users\Admin\AppData\Local\FluxCore\fluxcore_rsa
Size 3KB
SHA256 c54b9fbb0127a64acd2137a536c461bc1782ecfbd92e78acc2a16d1f15ee862a
MD5 0326855fdf221d358769ff461b230e7a
SHA1 6882df6642638fb320ba42552983c37ef99fb214
SHA512 f4a08c0d47af54b553fc6cbfcad582d106d4f91bd85b5101303e7c4479218c76b82fe7d02eb8200a24529d9c3dbe511a79672efefd4f5be492d1361c82d2f13d
TLSH
T155615C35BFC5859B9875F6D098D78D19D87ED3E284C83EFC41411CB04A60CA2BE5A560
MD5 SHA1 SHA512 TLSH

Submit Download

nvctl.exe

Path C:\Users\Admin\AppData\Local\FluxCore\nvctl.exe
Size 86KB
SHA256 d64da32a063e833d79a199ff1dd2cd2bbb2fd1d355a22f38e4d5233ce813b665
MD5 a523f371ea9ebcdc904d5b2f385a8bce
SHA1 6210387af04f74fad5d07676b9aab3cea1d18433
SHA512 4514bffeaf77ad548640ccfdfdb218bcb871a9abf129e7e88bc51bfd46a1549c6d43553072e0a9b0da18c56e78d8410bb8fbc5f02f83ebbf75854ef08cafe156
SSDEEP 1536:K/6l3MX7aEmnrfpJfPsY6UEQCNs42vzFSdWHJKmWLYsRq8IxercXs:N3MOEmnLpJfPsJUEQCNstLHJKzNq/x
TLSH
T124836C0374421AA8C423C0F896177A16962A7D58133082FF2BFA7D6D3E796F25EB7750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 34e67b0dd702582e6bf54d6638ffda3ab3caa4c3b05d2ae14bec832b9d16e949
MD5 b34a58b7434e8578b089fef0af3d0f17
SHA1 d15269291e82d18eb7ab463fbc5e7e355312cbc9
SHA512 93ec513338f13ca76fa3b3330c6a8d3aaaaae6e49a8610f4a52081de2773c23e7c75192e861ca969b9cd23cee702c974db59d6f706bf20e00b4cc4c9e14114e8
TLSH
T19F71765657836A1EEFAB177393DA48F7373886C67B076E120378A176988F384E2D3405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7541.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7541.TMP
Size 3KB
SHA256 f9a6ff8c0518a1be3d90e7e08b0331efac0987b8329817c6e3b8302943846b59
MD5 902e783c80f1e509f207ac882949c5ec
SHA1 87061e7e082dfb5e37ef967590557402d409d7e2
SHA512 c4f4bcd7d4f322eb577600758eeab7664ad53036e491df0fcf7e878bffe622718d3ca29dad760cfbc2133bcd752008dd3da9a38c86eb0c91315ebb0e23564bb2
TLSH
T1146174465783691AEBA7077393DA48F7377886D76B076E121378A176D88F384F2D3008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 5c1a447252c5f460ade1d442ec88dff2f4fbc85afd6aad1d5516573db1a975d3
MD5 88271be9714b5d3698810bcf20edf431
SHA1 d580951be68eca4ba476b1e2ba458d59164304a7
SHA512 090fe7d933a2905603323a01208c80da382dba387db31ba5300cb86aa341e8e11638627b26fde892b04c3e1cdb74711d84098a7ceb8f50ac26a55e8ef6af4b8c
TLSH
T17FB012A2389C2302C60C02786462D40024204D70BE06323381E0000DC011358215200D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 662b0ad827dc04d2cab02f9246e1ff415bd16f072480a9c77f79ad5919c98a12
MD5 3d837df77677e2ce7d6b4ae28b07e4e7
SHA1 238f95fb8fb7a9d47dac0fe605917cdd6924831a
SHA512 0db56aaaaf8387c12ba7b2965ec88aeda591254690d3b506013245f15428676bf1a5e27091fed0089c6083bfb8aa5f9f434439d66dffb22423d58794edc737d2
TLSH
T15D61E0F7C3E8856D8C1142F0BA186E2BCE2D0915832C3D1AC8D4DF5B93E2471E281A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8ab6146be2b26ee54bb213e747fee8d3e9f8472cde0969a74fbcd9795e8b5859
MD5 72655ebb3b5bcdf6d1c2a59d56f844ae
SHA1 6bbc55ef0ac85d69a52424b1792fd6e076a5a871
SHA512 994a612915835f08586da81c8873306a35995e53d9d3612ab37abaa90ef4935081077d5d34079eb7313cf2732e6b03a8e9bd2af7b6581f5ad1b35f8a1acb077c
SSDEEP 192:sxRV0bLRI5yM/jK1Ml8wcYN/f4euFsYv/RnyZr4tGwrXYczoA8ppVL5Vk/g6+WNk:sxRqCCm/f4eCsaRUEtGlo/5W/2F3u
TLSH
T19A62E915692459778CDBD30DFA95BB53D2F91472A2801E48EEFC8A1C01E77ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d98ad6353fcfc29574f39d2b86074936d360d8a90baf5c41a91a5c282a436cc5
MD5 e40dffd96e0b360daf74b4211fa35307
SHA1 cad7a4b4d82c7d49a8864f4eb2098ca7e57aec8d
SHA512 0e1959580356d2ea8d6a680910f4361c194af4887396490dcfc2c15bcb37ca0f765798136c8e176f304a8cc1b601f672839507f182271620c2f157738396ad35
SSDEEP 192:sxRVbbLRI5yM/jK1Ml8wcYN/f4euFsJ/RnyZr4tGwrXYczoA8ppVL5Vk/g6+WNJr:sxRpCCm/f4eCsNRUEtGlo/5W/2F3P
TLSH
T16C62D9156A2459778CDBD209FA95BB53D2F91472A2801E48EEFC8A1C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 77ef4ca20b1d2b8b60c8d1069e8a2bdf95d057797de21e8d6d1141aeb3934204
MD5 274343b170817e00012136a38e2d92dc
SHA1 cad24fd7af05f3a928a0ee2fdda8ee2fe8842f5e
SHA512 f8ae53c4e8a655161a5ab2af1ccb395460bc3273e7d61c2632e57e7cc018117851c750b68e124d759e3a6f84c7cc955d58bb440dd9871c53237aebea52c5e24d
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAdGe0GuroddsZE:7dUhBHE7tgWgEyf3wu1jaPdGRGldwE
TLSH
T10BE2FC3B680CCB7F4F404ADCE829BD9AADA901CF9698CD5447EA840C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 5f4a8700cf83dac894535894d4fed1e98a6b4f22c37dc08c01d85dd591bec228
MD5 9deda33646dc71fa0339ae99fc4c3595
SHA1 65c1be74986c3b5f6b3c8412c9407464c6c63794
SHA512 0b75e57d2789a6f70ab862748d8dd30bc0f7e9f1f28fa2413f289e3c062b55dca9bdf6576fe409fa0aea886316cd2dd6e4a0f6c18117d8aca24c25560ecc9759
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5a5342.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5342.TMP
Size 48B
SHA256 5bad89cfce83d5be2a9cc078b8d6b1ce6249535e45ec0694ac2ff0eb3f3c5827
MD5 5d84e88c72c22497a9065509f834d8c3
SHA1 6e1c3b3135d636650ae12a5282273769f6b609a6
SHA512 dcf22cf51d4ea65f896fbcf010452e038d64a26c038ae213510720d22daaa0212902f6798a67b2a4531a261aea35544870328e9aec92ebeab98387fd7a6c8db2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 23ba996d02d04ce62488aec0e4afa9eb3e86dcc6993407c01204a721eaa4aab5
MD5 bcc2bfde6d82e4dc64c419129d58e0de
SHA1 bc4c4a05d856333a16eca8ec8cb2191be4066379
SHA512 eaa236af7e582ad6c0e0b062915e2fb57c87fd767446f5445c654ee8fe884ae62930d1f118f3e66e303bc8907cfdc58ba99903c5c2d316848e80eb4aec575711
SSDEEP 96:Ks6cKnquy2EKLixm7KmgIIOW4tVgGOK47g0OcOGlkWPHjsJ9rK+Mz:CTn0m7KmgIIJ4tWGm7g09OGlkWPHjsJW
TLSH
T17C91A61937771B40383D3E1D82B4896F568270F3309A642B7BE816E52F26E424EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad8ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad8ae.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 956c8d42fb7a2acbbc7d1c3549dd2e528ee9569bec82f68123f3772b5bbffac7
MD5 31df0a44c738ff6025baaff20fb129d4
SHA1 37ef34a8945b8405d566c0d45943e0a9565d9e09
SHA512 abb6e80ff11b773d186979af0e91381313fb58566c11761e970f39e07682b9f642e96bcf72edb51b7137f1204dcf1fb56874fb5d9e6359390305175f229b5fb1
SSDEEP 768:hF1j+9O3UwgKOzc4iMcvnWgWWR+2SrXH78tRMec8Kz7:g9O3pOniJPWg1bSrozctz7
TLSH
T1671317F698D38D76D8AE8783633D6E429EBCC193B5885984F7C41D0CCD862BFD60A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3b1c17cf965fbdffafc415510f21b91ca97735e778a069565b50e826c6652f7a
MD5 a2c61571047e5302faa7b3ab964f123b
SHA1 9d4b405f1f71385044a57be9da559582da184115
SHA512 f4819b2e336cc10aaddd6fb74168d0ed9f65d41c88b118dbf56d929b28dc949657824110943ba2d15aa24502b170395be17923172b0fc2b3ad961871b2973c3d
SSDEEP 768:qj+9c3QO125koMcvnWgWWR+2SrXH78tRMec8Kz7:J9c3QOzoJPWg1bSrozctz7
TLSH
T1D9F2BF31B8658DB38CE2C68472177793FFF051E3D5895E48D4D86B0D028B79E2B0B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1813096c37752416b86d5a71e2a969f9b34d00d480b5390d3bdd1ea7720a3fd3
MD5 921bfeefb587bf0fbc578a45e5256d28
SHA1 1a575a04b52a27f061e9145cb42c098846b20875
SHA512 4db45088a71a1a47c8e91ef16ec81a59a7b774feb513ea3da05a8c20ef6c6f13bc7d616bbbbda93a4de247d946ccc05c3304b2b3897bbd77c7c8f7413896c1d3
SSDEEP 768:Orv+4UNbdp3/u5nMcvnWgWWR+2SrXH78tRkF+8rr6F:Obsb/3yJPWg1bSrocDr6
TLSH
T16803BF32A8689D73DCF2D685720A72037FF44193E6C91B88C4D91B4E429F9DE270BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d0b1897b9d13249567fa3b7d337ea27d26fcd223ccab6a1635a2e70dde508ccd
MD5 0e181fa7678cd5387dcf868d7748054b
SHA1 a53c33186bf95fbde526d45ee395a0af912c2f8e
SHA512 24ffda5e6d39e73cda77b649ed7e584644618ac59af4405022ecd324707026443999e715dde3c5099e1fe6760ad54d4e7be5922cbb991351e9904bed811a432f
SSDEEP 768:xrv+4UNbdm3QOk25kqMcvnWgWWR+2SrXH78tRMec8KzQ:xbsbo3QOgqJPWg1bSrozctzQ
TLSH
T15113CF32B8689DB38CF2D684B117B743BFB411D3D9894E48E4D51B0D028B9DE3B0B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b73a701-ea0f-425a-a713-b13b42aa8e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b73a701-ea0f-425a-a713-b13b42aa8e2e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ae8627e020b1312f18939f14294218f133c94c33b789657875c0450f82db543
MD5 2690102b651df93308ec330fb02ebaf0
SHA1 ab567cd2051aebe6cd2f1a820b4f929f54a4c1af
SHA512 7223355d2e4faae9ee6f647f58e6df2038558d328d627b445dfc0426eb7e9d982df7af2319bd8a1eeb1060b5d90fcf4cbf73a4267da83637edf38a8b26099dd2
TLSH
T1DF318837F3DC8615C899113A10CDAC1032BAC7DB409ECFAB6B80D265A83F6A9DF61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f585990da03057a83e3908a355a2b23245155e00bba01500a91510aa0249b4e8
MD5 e262bdca205220e7246f79cb286e8b1d
SHA1 0f45f0dfc743d781f5a6a843c70351ce68117332
SHA512 c175b54dbf8bfb97fab70e3332f320fcf1773084e518dc707c3a3837e0568b380fee4cdde32107e2ef1f55866ebf49f4abf3b791f5621056853dc908a4e5974f
TLSH
T15C117A33F3CC8724DC9A417650CEEC1036B6CBDB409ECE5BAB84D548B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd6282fb9e48e13ff2eeefa500698aeee850225b2ffb48ece70c4f434d13f106
MD5 402e67f60e29a956fc0302e299e38154
SHA1 987af2cf3f5c1f1bf15f2e19645aa3f5b30e518f
SHA512 61b988fd11e5e295d77dd204ac60a39ea671c8846e835a37f90c972791d48d0155f685cc0977518a43c9726d681c912f023bf2551763ec2305a44d9817f96ce2
TLSH
T120318837B3DC8615CC99103A10CDAC1032BAC7DB409ECFAB6B80D265A83F6A9DF61150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kuvurql1.2hj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kuvurql1.2hj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6012_1812776550\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-23-0x000002BFA91C0000-0x000002BFA91EA000-memory.dmp

Download

memory/976-22-0x000002BFA9180000-0x000002BFA918A000-memory.dmp

Download

memory/976-19-0x000002BFA9190000-0x000002BFA91AE000-memory.dmp

Download

memory/976-21-0x000002BFA9170000-0x000002BFA917A000-memory.dmp

Download

memory/976-24-0x000002BFA91C0000-0x000002BFA91E4000-memory.dmp

Download

memory/976-18-0x000002BF90BD0000-0x000002BF90BDA000-memory.dmp

Download

memory/976-16-0x000002BFA8D30000-0x000002BFA8D4E000-memory.dmp

Download

memory/976-17-0x000002BFA8F60000-0x000002BFA9012000-memory.dmp

Download

memory/1792-10-0x00007FF67FF00000-0x00007FF680F00000-memory.dmp

Download

memory/2776-40-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-37-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-38-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-39-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-36-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-41-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-30-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/2776-32-0x0000018E8CBD0000-0x0000018E8CBD1000-memory.dmp

Download

memory/3172-148-0x000002346CDD0000-0x000002346CE82000-memory.dmp

Download

memory/5172-6-0x000001FDE30F0000-0x000001FDE3112000-memory.dmp

Download

memory/5736-145-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Download

memory/5736-144-0x00000000059E0000-0x0000000005A32000-memory.dmp

Download

memory/5736-140-0x0000000000F50000-0x0000000000F5A000-memory.dmp

Download