ed56273a41bd8e136db511c9dda03bdfa939aeb36968b26d750a2278a3e7e405

Resubmissions

15/07/2026, 03:47

260715-ecqghaa14l8

15/07/2026, 03:43

260715-eabkkaa12r8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Untitled.rtf
Size 942B
Sample260715-eabkkaa12r
SHA256 ed56273a41bd8e136db511c9dda03bdfa939aeb36968b26d750a2278a3e7e405
MD5 db1839878b434ebc9d08cdc009208d39
SHA1 0d22803b2b40ade1c2fef12881ea32d05fbdecfc
SHA512 749decef395af5653f7d1f71181d984985845ea4440c1434f9da74e1f5ac99fac8741a989c4361557bb41bde34881844be4ba9d175e3c5ac5573a87c1990e5a5
TLSH
T1AD1150BEE440C1619296D38ED5C4CABD33A463109346ECC2E4A03AA9CA34DBD3989D06
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
114	460	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	NetLock_RMM_User_Process.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
3476	NetLock_RMM_Agent_Comm.exe
6220	NetLock_RMM_User_Process.exe
4216	NetLock_RMM_Agent_Remote.exe
6348	NetLock_RMM_User_Process_UAC.exe
4192	NetLock_RMM_Agent_Health.exe

Loads dropped DLL 4 IoCs

pid	Process
6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
3476	NetLock_RMM_Agent_Comm.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetLock RMM User Process Launcher = "\"C:\\Program Files\\0x101 Cyber Security\\NetLock RMM\\User Process\\NetLock_RMM_User_Process.exe\" --launch-uac"	NetLock_RMM_Agent_Comm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\arm64\mttvdd.cat	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process_UAC.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\arm64\MttVDD.inf	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\NetLock_RMM_Tray_Icon.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process_UAC.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\Microsoft.Data.SqlClient.SNI.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\x64\MttVDD.inf	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\libHarfBuzzSharp.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\libHarfBuzzSharp.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\NetLock_RMM_Tray_Icon.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\libSkiaSharp.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\arm64\MttVDD.inf	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\e_sqlite3.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\x64\MttVDD.inf	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\global.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\e_sqlite3.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\x64\mttvdd.cat	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\x64\mttvdd.cat	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\Microsoft.Data.SqlClient.SNI.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\appsettings.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\DisplayDriver\arm64\mttvdd.cat	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Tray Icon\libSkiaSharp.dll	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File created	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\appsettings.Development.json	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
File opened for modification	C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4720	sc.exe
5764	sc.exe
5824	sc.exe
2140	sc.exe
3844	sc.exe
6088	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
460	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2848	taskkill.exe
5292	taskkill.exe
5392	taskkill.exe
5288	taskkill.exe
2952	taskkill.exe
7000	taskkill.exe
7156	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	NetLock_RMM_Agent_Comm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3872	WINWORD.EXE
3872	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
6348	NetLock_RMM_User_Process_UAC.exe
4216	NetLock_RMM_Agent_Remote.exe
4216	NetLock_RMM_Agent_Remote.exe
1848	powershell.exe
1848	powershell.exe
3232	chrome.exe
3232	chrome.exe
1848	powershell.exe
4216	NetLock_RMM_Agent_Remote.exe
4192	NetLock_RMM_Agent_Health.exe
4192	NetLock_RMM_Agent_Health.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
4216	NetLock_RMM_Agent_Remote.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
4216	NetLock_RMM_Agent_Remote.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe
3476	NetLock_RMM_Agent_Comm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1204	2792	chrome.exe	98
PID 2792 wrote to memory of 116	2792	chrome.exe	99
PID 2792 wrote to memory of 116	2792	chrome.exe	99
PID 2792 wrote to memory of 460	2792	chrome.exe	100
PID 2792 wrote to memory of 2216	2792	chrome.exe	101
PID 2792 wrote to memory of 2216	2792	chrome.exe	101
PID 2792 wrote to memory of 4852	2792	chrome.exe	103
PID 2792 wrote to memory of 4556	2792	chrome.exe	104
PID 2792 wrote to memory of 4852	2792	chrome.exe	103
PID 2792 wrote to memory of 4556	2792	chrome.exe	104
PID 2792 wrote to memory of 1488	2792	chrome.exe	105
PID 2792 wrote to memory of 1488	2792	chrome.exe	105
PID 2792 wrote to memory of 3504	2792	chrome.exe	106
PID 2792 wrote to memory of 3504	2792	chrome.exe	106
PID 2792 wrote to memory of 2224	2792	chrome.exe	107
PID 2792 wrote to memory of 2224	2792	chrome.exe	107
PID 2792 wrote to memory of 1084	2792	chrome.exe	108
PID 2792 wrote to memory of 1084	2792	chrome.exe	108
PID 2792 wrote to memory of 3940	2792	chrome.exe	111
PID 2792 wrote to memory of 7076	2792	chrome.exe	114
PID 2792 wrote to memory of 7076	2792	chrome.exe	114
PID 2792 wrote to memory of 5904	2792	chrome.exe	116
PID 2792 wrote to memory of 5912	2792	chrome.exe	117
PID 2792 wrote to memory of 5924	2792	chrome.exe	118
PID 2792 wrote to memory of 6316	2792	chrome.exe	120
PID 6680 wrote to memory of 6952	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	124
PID 6952 wrote to memory of 7000	6952	cmd.exe	126
PID 6680 wrote to memory of 7052	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	127
PID 7052 wrote to memory of 7156	7052	cmd.exe	129
PID 6680 wrote to memory of 2360	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	130
PID 2360 wrote to memory of 2848	2360	cmd.exe	132
PID 6680 wrote to memory of 4852	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	133
PID 4852 wrote to memory of 5292	4852	cmd.exe	135
PID 6680 wrote to memory of 5336	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	136
PID 5336 wrote to memory of 5392	5336	cmd.exe	138
PID 6680 wrote to memory of 5440	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	139
PID 5440 wrote to memory of 5288	5440	cmd.exe	141
PID 6680 wrote to memory of 5556	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	142
PID 5556 wrote to memory of 2952	5556	cmd.exe	144
PID 6680 wrote to memory of 5660	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	145
PID 5660 wrote to memory of 4720	5660	cmd.exe	147
PID 6680 wrote to memory of 5716	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	148
PID 5716 wrote to memory of 5764	5716	cmd.exe	150
PID 6680 wrote to memory of 5776	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	151
PID 5776 wrote to memory of 5824	5776	cmd.exe	153
PID 6680 wrote to memory of 2140	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	154
PID 6680 wrote to memory of 3844	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	156
PID 6680 wrote to memory of 6088	6680	IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe	158
PID 6220 wrote to memory of 6348	6220	NetLock_RMM_User_Process.exe	164
PID 3476 wrote to memory of 1848	3476	NetLock_RMM_Agent_Comm.exe	165
PID 2792 wrote to memory of 3232	2792	chrome.exe	167
PID 3476 wrote to memory of 5564	3476	NetLock_RMM_Agent_Comm.exe	174

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "1"	NetLock_RMM_Agent_Comm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Untitled.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbb7d3c728,0x7ffbb7d3c734,0x7ffbb7d3c740
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,17956608812980967185,6710287718321131823,262144 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,3239802485967409692,13527758110261100852,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5876149066547710883,2157142688515207616,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,1918979563134676217,9410249403503322481,2097152 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,16294899458698308304,17679905608219720225,2097152 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,13701528964669038606,8419288300835074198,2097152 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,25516894672946690,11315069168205814602,2097152 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,17172396333375686092,1145098026739687323,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,3324358435017768886,7853907923428732094,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,1195019702980604746,8795853326362741968,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5596,i,7061602250482222939,4382028436461076815,2097152 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:7076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,10306525532385565084,8558864223579422543,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,4691536058608966114,3144289309602258292,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,16962469517156350599,6798487556433261562,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3596,i,6648558906989431778,12086736943921330396,524288 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3872 /prefetch:8
  2⤵
  PID:6316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5748,i,13857702439648702757,13495835604201309941,262144 --field-trial-handle=1916,i,11380007187546791508,15750626981105938010,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6576

C:\Users\Admin\Downloads\IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe
"C:\Users\Admin\Downloads\IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6680
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_Agent_Comm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_Agent_Comm.exe"
    3⤵
    - Kills process with taskkill
    PID:7000
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_Agent_Remote.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_Agent_Remote.exe"
    3⤵
    - Kills process with taskkill
    PID:7156
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_Agent_Health.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_Agent_Health.exe"
    3⤵
    - Kills process with taskkill
    PID:2848
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_User_Process.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_User_Process.exe"
    3⤵
    - Kills process with taskkill
    PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_User_Process_UAC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_User_Process_UAC.exe"
    3⤵
    - Kills process with taskkill
    PID:5392
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock RMM User Process.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock RMM User Process.exe"
    3⤵
    - Kills process with taskkill
    PID:5288
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c taskkill /F /IM "NetLock_RMM_Tray_Icon.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "NetLock_RMM_Tray_Icon.exe"
    3⤵
    - Kills process with taskkill
    PID:2952
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc delete NetLock_RMM_Agent_Comm
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\sc.exe
    sc delete NetLock_RMM_Agent_Comm
    3⤵
    - Launches sc.exe
    PID:4720
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc delete NetLock_RMM_Agent_Remote
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\sc.exe
    sc delete NetLock_RMM_Agent_Remote
    3⤵
    - Launches sc.exe
    PID:5764
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc delete NetLock_RMM_Agent_Health
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\sc.exe
    sc delete NetLock_RMM_Agent_Health
    3⤵
    - Launches sc.exe
    PID:5824
- C:\Windows\SYSTEM32\sc.exe
  "sc" create NetLock_RMM_Agent_Comm binPath= "C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:2140
- C:\Windows\SYSTEM32\sc.exe
  "sc" create NetLock_RMM_Agent_Remote binPath= "C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:3844
- C:\Windows\SYSTEM32\sc.exe
  "sc" create NetLock_RMM_Agent_Health binPath= "C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:6088

C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe
"C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABQAHIAbwBmAGkAbABlACAALQBOAGEAbQBlACAARABvAG0AYQBpAG4AKQAuAEUAbgBhAGIAbABlAGQAIAAtAGEAbgBkACAAKABHAGUAdAAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABQAHIAbwBmAGkAbABlACAALQBOAGEAbQBlACAAUAByAGkAdgBhAHQAZQApAC4ARQBuAGEAYgBsAGUAZAAgAC0AYQBuAGQAIAAoAEcAZQB0AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFAAcgBvAGYAaQBsAGUAIAAtAE4AYQBtAGUAIABQAHUAYgBsAGkAYwApAC4ARQBuAGEAYgBsAGUAZAA=
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIAAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgAEMAZwBBAGsAQQBIAE0AQQBaAFEAQgB6AEEASABNAEEAYQBRAEIAdgBBAEcANABBAEkAQQBBADkAQQBDAEEAQQBUAGcAQgBsAEEASABjAEEATABRAEIAUABBAEcASQBBAGEAZwBCAGwAQQBHAE0AQQBkAEEAQQBnAEEAQwAwAEEAUQB3AEIAdgBBAEcAMABBAFQAdwBCAGkAQQBHAG8AQQBaAFEAQgBqAEEASABRAEEASQBBAEIATgBBAEcAawBBAFkAdwBCAHkAQQBHADgAQQBjAHcAQgB2AEEARwBZAEEAZABBAEEAdQBBAEYAVQBBAGMAQQBCAGsAQQBHAEUAQQBkAEEAQgBsAEEAQwA0AEEAVQB3AEIAbABBAEgATQBBAGMAdwBCAHAAQQBHADgAQQBiAGcAQQBLAEEAQwBRAEEAYwB3AEIAbABBAEcARQBBAGMAZwBCAGoAQQBHAGcAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMAUQBBAGMAdwBCAGwAQQBIAE0AQQBjAHcAQgBwAEEARwA4AEEAYgBnAEEAdQBBAEUATQBBAGMAZwBCAGwAQQBHAEUAQQBkAEEAQgBsAEEARgBVAEEAYwBBAEIAawBBAEcARQBBAGQAQQBCAGwAQQBGAE0AQQBaAFEAQgBoAEEASABJAEEAWQB3AEIAbwBBAEcAVQBBAGMAZwBBAG8AQQBDAGsAQQBDAGcAQQBLAEEASABRAEEAYwBnAEIANQBBAEMAQQBBAGUAdwBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASgBBAEIAeQBBAEcAVQBBAGMAdwBCADEAQQBHAHcAQQBkAEEAQQBnAEEARAAwAEEASQBBAEEAawBBAEgATQBBAFoAUQBCAGgAQQBIAEkAQQBZAHcAQgBvAEEARwBVAEEAYwBnAEEAdQBBAEYATQBBAFoAUQBCAGgAQQBIAEkAQQBZAHcAQgBvAEEAQwBnAEEASgB3AEIASgBBAEgATQBBAFMAUQBCAHUAQQBIAE0AQQBkAEEAQgBoAEEARwB3AEEAYgBBAEIAbABBAEcAUQBBAFAAUQBBAHcAQQBDAEEAQQBUAHcAQgBTAEEAQwBBAEEAUwBRAEIAegBBAEUAawBBAGIAZwBCAHoAQQBIAFEAQQBZAFEAQgBzAEEARwB3AEEAWgBRAEIAawBBAEQAMABBAE0AUQBBAG4AQQBDAGsAQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEAYwB3AEEAZwBBAEQAMABBAEkAQQBCAEEAQQBDAGcAQQBLAFEAQQBLAEEAQQBvAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCAG0AQQBHADgAQQBjAGcAQgBsAEEARwBFAEEAWQB3AEIAbwBBAEMAQQBBAEsAQQBBAGsAQQBIAFUAQQBjAEEAQgBrAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAGEAUQBCAHUAQQBDAEEAQQBKAEEAQgB5AEEARwBVAEEAYwB3AEIAMQBBAEcAdwBBAGQAQQBBAHUAQQBGAFUAQQBjAEEAQgBrAEEARwBFAEEAZABBAEIAbABBAEgATQBBAEsAUQBBAGcAQQBIAHMAQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAEEAQgByAEEARwBJAEEAVABnAEIAMQBBAEcAMABBAFkAZwBCAGwAQQBIAEkAQQBjAHcAQQBnAEEARAAwAEEASQBBAEIAQQBBAEMAZwBBAEsAUQBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCAG0AQQBHADgAQQBjAGcAQgBsAEEARwBFAEEAWQB3AEIAbwBBAEMAQQBBAEsAQQBBAGsAQQBHAHMAQQBZAGcAQQBnAEEARwBrAEEAYgBnAEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEATABnAEIATABBAEUASQBBAFEAUQBCAHkAQQBIAFEAQQBhAFEAQgBqAEEARwB3AEEAWgBRAEIASgBBAEUAUQBBAGMAdwBBAHAAQQBDAEEAQQBlAHcAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAUQBBAGEAdwBCAGkAQQBFADQAQQBkAFEAQgB0AEEARwBJAEEAWgBRAEIAeQBBAEgATQBBAEkAQQBBAHIAQQBEADAAQQBJAEEAQQBuAEEARQBzAEEAUQBnAEEAbgBBAEMAQQBBAEsAdwBBAGcAQQBDAFEAQQBhAHcAQgBpAEEAQQBvAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEASAAwAEEAQwBnAEEASwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAawBBAEcATQBBAGQAZwBCAGwAQQBFAGsAQQBaAEEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEUAQQBBAEsAQQBBAHAAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBHAFkAQQBiAHcAQgB5AEEARwBVAEEAWQBRAEIAagBBAEcAZwBBAEkAQQBBAG8AQQBDAFEAQQBZAHcAQgAyAEEARwBVAEEASQBBAEIAcABBAEcANABBAEkAQQBBAGsAQQBIAFUAQQBjAEEAQgBrAEEARwBFAEEAZABBAEIAbABBAEMANABBAFEAdwBCADIAQQBHAFUAQQBTAFEAQgBFAEEASABNAEEASwBRAEEAZwBBAEgAcwBBAEMAZwBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBrAEEARwBNAEEAZABnAEIAbABBAEUAawBBAFoAQQBCAHoAQQBDAEEAQQBLAHcAQQA5AEEAQwBBAEEASgBBAEIAagBBAEgAWQBBAFoAUQBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCADkAQQBBAG8AQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAEEAQgB6AEEARwBVAEEAZABnAEIAbABBAEgASQBBAGEAUQBCADAAQQBIAGsAQQBJAEEAQQA5AEEAQwBBAEEASgB3AEIAVgBBAEcANABBAGMAdwBCAHcAQQBHAFUAQQBZAHcAQgBwAEEARwBZAEEAYQBRAEIAbABBAEcAUQBBAEoAdwBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCAHAAQQBHAFkAQQBJAEEAQQBvAEEAQwBRAEEAZABRAEIAdwBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBMAGcAQgBOAEEASABNAEEAYwBnAEIAagBBAEYATQBBAFoAUQBCADIAQQBHAFUAQQBjAGcAQgBwAEEASABRAEEAZQBRAEEAcABBAEMAQQBBAGUAdwBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBRAEEAYwB3AEIAbABBAEgAWQBBAFoAUQBCAHkAQQBHAGsAQQBkAEEAQgA1AEEAQwBBAEEAUABRAEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEATABnAEIATgBBAEgATQBBAGMAZwBCAGoAQQBGAE0AQQBaAFEAQgAyAEEARwBVAEEAYwBnAEIAcABBAEgAUQBBAGUAUQBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCADkAQQBBAG8AQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBCAFUAQQBIAGsAQQBjAEEAQgBsAEEAQwBBAEEAUABRAEEAZwBBAEMAYwBBAFQAdwBCADAAQQBHAGcAQQBaAFEAQgB5AEEAQwBjAEEAQwBnAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEAWgBnAEIAdgBBAEgASQBBAFoAUQBCAGgAQQBHAE0AQQBhAEEAQQBnAEEAQwBnAEEASgBBAEIAagBBAEcARQBBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQQBnAEEAQwBRAEEAZABRAEIAdwBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBMAGcAQgBEAEEARwBFAEEAZABBAEIAbABBAEcAYwBBAGIAdwBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEASQBBAEIANwBBAEEAbwBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEcATQBBAFkAUQBCADAAQQBDADQAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEAZwBBAEMAMABBAGIAUQBCAGgAQQBIAFEAQQBZAHcAQgBvAEEAQwBBAEEASgB3AEIAVABBAEcAVQBBAFkAdwBCADEAQQBIAEkAQQBhAFEAQgAwAEEASABrAEEASgB3AEEAcABBAEMAQQBBAGUAdwBBAGcAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAFYAQQBCADUAQQBIAEEAQQBaAFEAQQBnAEEARAAwAEEASQBBAEEAbgBBAEYATQBBAFoAUQBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABRAEEAZQBRAEEAbgBBAEQAcwBBAEkAQQBCAGkAQQBIAEkAQQBaAFEAQgBoAEEARwBzAEEASQBBAEIAOQBBAEEAbwBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBaAFEAQgBzAEEASABNAEEAWgBRAEIAcABBAEcAWQBBAEkAQQBBAG8AQQBDAFEAQQBZAHcAQgBoAEEASABRAEEATABnAEIATwBBAEcARQBBAGIAUQBCAGwAQQBDAEEAQQBMAFEAQgB0AEEARwBFAEEAZABBAEIAagBBAEcAZwBBAEkAQQBBAG4AQQBFAFEAQQBaAFEAQgBtAEEARwBrAEEAYgBnAEIAcABBAEgAUQBBAGEAUQBCAHYAQQBHADQAQQBKAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEAVgBBAEIANQBBAEgAQQBBAFoAUQBBAGcAQQBEADAAQQBJAEEAQQBuAEEARQBRAEEAWgBRAEIAbQBBAEcAawBBAGIAZwBCAHAAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASgB3AEEANwBBAEMAQQBBAFkAZwBCAHkAQQBHAFUAQQBZAFEAQgByAEEAQwBBAEEAZgBRAEEASwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBHAFUAQQBiAEEAQgB6AEEARwBVAEEAYQBRAEIAbQBBAEMAQQBBAEsAQQBBAGsAQQBHAE0AQQBZAFEAQgAwAEEAQwA0AEEAVABnAEIAaABBAEcAMABBAFoAUQBBAGcAQQBDADAAQQBiAFEAQgBoAEEASABRAEEAWQB3AEIAbwBBAEMAQQBBAEoAdwBCAEQAQQBIAEkAQQBhAFEAQgAwAEEARwBrAEEAWQB3AEIAaABBAEcAdwBBAEoAdwBBAHAAQQBDAEEAQQBlAHcAQQBnAEEAQwBRAEEAZABRAEIAdwBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBWAEEAQgA1AEEASABBAEEAWgBRAEEAZwBBAEQAMABBAEkAQQBBAG4AQQBGAE0AQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAcABBAEgAUQBBAGUAUQBBAG4AQQBEAHMAQQBJAEEAQgBpAEEASABJAEEAWgBRAEIAaABBAEcAcwBBAEkAQQBCADkAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEAWgBRAEIAcwBBAEgATQBBAFoAUQBCAHAAQQBHAFkAQQBJAEEAQQBvAEEAQwBRAEEAWQB3AEIAaABBAEgAUQBBAEwAZwBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQwBBAEEATABRAEIAdABBAEcARQBBAGQAQQBCAGoAQQBHAGcAQQBJAEEAQQBuAEEARQBZAEEAWgBRAEIAaABBAEgAUQBBAGQAUQBCAHkAQQBHAFUAQQBKAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEAVgBBAEIANQBBAEgAQQBBAFoAUQBBAGcAQQBEADAAQQBJAEEAQQBuAEEARQBZAEEAWgBRAEIAaABBAEgAUQBBAGQAUQBCAHkAQQBHAFUAQQBKAHcAQQA3AEEAQwBBAEEAWQBnAEIAeQBBAEcAVQBBAFkAUQBCAHIAQQBDAEEAQQBmAFEAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEcAVQBBAGIAQQBCAHoAQQBHAFUAQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEcATQBBAFkAUQBCADAAQQBDADQAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEAZwBBAEMAMABBAGIAUQBCAGgAQQBIAFEAQQBZAHcAQgBvAEEAQwBBAEEASgB3AEIARQBBAEgASQBBAGEAUQBCADIAQQBHAFUAQQBjAGcAQQBuAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAEoAQQBCADEAQQBIAEEAQQBaAEEAQgBoAEEASABRAEEAWgBRAEIAVQBBAEgAawBBAGMAQQBCAGwAQQBDAEEAQQBQAFEAQQBnAEEAQwBjAEEAUgBBAEIAeQBBAEcAawBBAGQAZwBCAGwAQQBIAEkAQQBKAHcAQQA3AEEAQwBBAEEAWQBnAEIAeQBBAEcAVQBBAFkAUQBCAHIAQQBDAEEAQQBmAFEAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEcAVQBBAGIAQQBCAHoAQQBHAFUAQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEcATQBBAFkAUQBCADAAQQBDADQAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEAZwBBAEMAMABBAGIAUQBCAGgAQQBIAFEAQQBZAHcAQgBvAEEAQwBBAEEASgB3AEIAVABBAEcAVQBBAGMAZwBCADIAQQBHAGsAQQBZAHcAQgBsAEEAQwBBAEEAVQBBAEIAaABBAEcATQBBAGEAdwBBAG4AQQBDAGsAQQBJAEEAQgA3AEEAQwBBAEEASgBBAEIAMQBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQgBVAEEASABrAEEAYwBBAEIAbABBAEMAQQBBAFAAUQBBAGcAQQBDAGMAQQBVAHcAQgBsAEEASABJAEEAZABnAEIAcABBAEcATQBBAFoAUQBCAFEAQQBHAEUAQQBZAHcAQgByAEEAQwBjAEEATwB3AEEAZwBBAEcASQBBAGMAZwBCAGwAQQBHAEUAQQBhAHcAQQBnAEEASAAwAEEAQwBnAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCAGwAQQBHAHcAQQBjAHcAQgBsAEEARwBrAEEAWgBnAEEAZwBBAEMAZwBBAEoAQQBCAGoAQQBHAEUAQQBkAEEAQQB1AEEARQA0AEEAWQBRAEIAdABBAEcAVQBBAEkAQQBBAHQAQQBHADAAQQBZAFEAQgAwAEEARwBNAEEAYQBBAEEAZwBBAEMAYwBBAFYAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEASQBBAEIAUwBBAEcAOABBAGIAQQBCAHMAQQBIAFUAQQBjAEEAQQBuAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAEoAQQBCADEAQQBIAEEAQQBaAEEAQgBoAEEASABRAEEAWgBRAEIAVQBBAEgAawBBAGMAQQBCAGwAQQBDAEEAQQBQAFEAQQBnAEEAQwBjAEEAVQBnAEIAdgBBAEcAdwBBAGIAQQBCADEAQQBIAEEAQQBKAHcAQQA3AEEAQwBBAEEAWQBnAEIAeQBBAEcAVQBBAFkAUQBCAHIAQQBDAEEAQQBmAFEAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQgA5AEEAQQBvAEEAQwBnAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASgBBAEIAegBBAEgAVQBBAGMAQQBCAHcAQQBHADgAQQBjAGcAQgAwAEEARgBVAEEAYwBnAEIAcwBBAEMAQQBBAFAAUQBBAGcAQQBDAGMAQQBKAHcAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQgBwAEEARwBZAEEASQBBAEEAbwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAVABBAEgAVQBBAGMAQQBCAHcAQQBHADgAQQBjAGcAQgAwAEEARgBVAEEAYwBnAEIAcwBBAEMAawBBAEkAQQBCADcAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASgBBAEIAegBBAEgAVQBBAGMAQQBCAHcAQQBHADgAQQBjAGcAQgAwAEEARgBVAEEAYwBnAEIAcwBBAEMAQQBBAFAAUQBBAGcAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAFQAQQBIAFUAQQBjAEEAQgB3AEEARwA4AEEAYwBnAEIAMABBAEYAVQBBAGMAZwBCAHMAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBIADAAQQBDAGcAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBrAEEARwBzAEEAWQBnAEIASgBBAEcAUQBBAEkAQQBBADkAQQBDAEEAQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEcAcwBBAFkAZwBCAE8AQQBIAFUAQQBiAFEAQgBpAEEARwBVAEEAYwBnAEIAegBBAEMANABBAFEAdwBCAHYAQQBIAFUAQQBiAGcAQgAwAEEAQwBBAEEATABRAEIAbgBBAEgAUQBBAEkAQQBBAHcAQQBDAGsAQQBJAEEAQgA3AEEAQwBBAEEASgBBAEIAcgBBAEcASQBBAFQAZwBCADEAQQBHADAAQQBZAGcAQgBsAEEASABJAEEAYwB3AEIAYgBBAEQAQQBBAFgAUQBBAGcAQQBIADAAQQBJAEEAQgBsAEEARwB3AEEAYwB3AEIAbABBAEMAQQBBAGUAdwBBAGcAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAEoAQQBHAFEAQQBaAFEAQgB1AEEASABRAEEAYQBRAEIAMABBAEgAawBBAEwAZwBCAFYAQQBIAEEAQQBaAEEAQgBoAEEASABRAEEAWgBRAEIASgBBAEUAUQBBAEkAQQBCADkAQQBBAG8AQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAEEAQgB2AEEARwBJAEEAYQBnAEEAZwBBAEQAMABBAEkAQQBCAEEAQQBIAHMAQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEIAMQBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQgBmAEEARwBrAEEAWgBBAEEAZwBBAEQAMABBAEkAQQBBAGsAQQBHAHMAQQBZAGcAQgBKAEEARwBRAEEAQwBnAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCADMAQQBIAFUAQQBZAFEAQgBmAEEARwBjAEEAZABRAEIAcABBAEcAUQBBAEkAQQBBADkAQQBDAEEAQQBKAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBBAHUAQQBFAGsAQQBaAEEAQgBsAEEARwA0AEEAZABBAEIAcABBAEgAUQBBAGUAUQBBAHUAQQBGAFUAQQBjAEEAQgBrAEEARwBFAEEAZABBAEIAbABBAEUAawBBAFIAQQBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEARwA0AEEAWQBRAEIAdABBAEcAVQBBAEkAQQBBADkAQQBDAEEAQQBKAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBBAHUAQQBGAFEAQQBhAFEAQgAwAEEARwB3AEEAWgBRAEEASwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBIAFkAQQBaAFEAQgB5AEEASABNAEEAYQBRAEIAdgBBAEcANABBAEkAQQBBADkAQQBDAEEAQQBKAHcAQQBuAEEAQQBvAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAGMAdwBCAGwAQQBIAFkAQQBaAFEAQgB5AEEARwBrAEEAZABBAEIANQBBAEMAQQBBAFAAUQBBAGcAQQBDAFEAQQBjAHcAQgBsAEEASABZAEEAWgBRAEIAeQBBAEcAawBBAGQAQQBCADUAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEAZABRAEIAdwBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBYAHcAQgAwAEEASABrAEEAYwBBAEIAbABBAEMAQQBBAFAAUQBBAGcAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAFYAQQBCADUAQQBIAEEAQQBaAFEAQQBLAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEcAawBBAGMAdwBCAGYAQQBHAGsAQQBiAGcAQgB6AEEASABRAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCAGsAQQBDAEEAQQBQAFEAQQBnAEEARgBzAEEAWQBnAEIAdgBBAEcAOABBAGIAQQBCAGQAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAEoAQQBIAE0AQQBTAFEAQgB1AEEASABNAEEAZABBAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEIAagBBAEgAWQBBAFoAUQBCAGYAQQBHAGsAQQBaAEEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMAUQBBAFkAdwBCADIAQQBHAFUAQQBTAFEAQgBrAEEASABNAEEAQwBnAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCAHoAQQBIAFUAQQBjAEEAQgB3AEEARwA4AEEAYwBnAEIAMABBAEYAOABBAGQAUQBCAHkAQQBHAHcAQQBJAEEAQQA5AEEAQwBBAEEASgBBAEIAegBBAEgAVQBBAGMAQQBCAHcAQQBHADgAQQBjAGcAQgAwAEEARgBVAEEAYwBnAEIAcwBBAEEAbwBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBaAEEAQgBsAEEASABNAEEAWQB3AEIAeQBBAEcAawBBAGMAQQBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAUABRAEEAZwBBAEcAawBBAFoAZwBBAGcAQQBDAGcAQQBKAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBBAHUAQQBFAFEAQQBaAFEAQgB6AEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEMAUQBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEATABnAEIARQBBAEcAVQBBAGMAdwBCAGoAQQBIAEkAQQBhAFEAQgB3AEEASABRAEEAYQBRAEIAdgBBAEcANABBAEwAZwBCAFQAQQBIAFUAQQBZAGcAQgB6AEEASABRAEEAYwBnAEIAcABBAEcANABBAFoAdwBBAG8AQQBEAEEAQQBMAEEAQQBnAEEARgBzAEEAVABRAEIAaABBAEgAUQBBAGEAQQBCAGQAQQBEAG8AQQBPAGcAQgBOAEEARwBrAEEAYgBnAEEAbwBBAEQAVQBBAE0AQQBBAHcAQQBDAHcAQQBJAEEAQQBrAEEASABVAEEAYwBBAEIAawBBAEcARQBBAGQAQQBCAGwAQQBDADQAQQBSAEEAQgBsAEEASABNAEEAWQB3AEIAeQBBAEcAawBBAGMAQQBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwA0AEEAVABBAEIAbABBAEcANABBAFoAdwBCADAAQQBHAGcAQQBLAFEAQQBwAEEAQwBBAEEAZgBRAEEAZwBBAEcAVQBBAGIAQQBCAHoAQQBHAFUAQQBJAEEAQgA3AEEAQwBBAEEASgB3AEEAbgBBAEMAQQBBAGYAUQBBAEsAQQBDAEEAQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBCADkAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEMAQQBBAEkAQQBBAGcAQQBDAFEAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAGMAdwBBAGcAQQBDAHMAQQBQAFEAQQBnAEEAQwBRAEEAYgB3AEIAaQBBAEcAbwBBAEMAZwBBAGcAQQBDAEEAQQBJAEEAQQBnAEEASAAwAEEAQwBnAEEASwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBCAHoAQQBDAEEAQQBmAEEAQQBnAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBWAEEAQgB2AEEAQwAwAEEAUwBnAEIAegBBAEcAOABBAGIAZwBBAGcAQQBDADAAQQBSAEEAQgBsAEEASABBAEEAZABBAEIAbwBBAEMAQQBBAE4AUQBBAEsAQQBIADAAQQBJAEEAQgBqAEEARwBFAEEAZABBAEIAagBBAEcAZwBBAEkAQQBCADcAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAbgBBAEYAcwBBAFgAUQBBAG4AQQBBAG8AQQBmAFEAQQBLAEEAQQA9AD0A
  2⤵
  - Modifies data under HKEY_USERS
  PID:5564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAkAHMAZQBzAHMAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABNAGkAYwByAG8AcwBvAGYAdAAuAFUAcABkAGEAdABlAC4AUwBlAHMAcwBpAG8AbgAKACQAcwBlAGEAcgBjAGgAZQByACAAPQAgACQAcwBlAHMAcwBpAG8AbgAuAEMAcgBlAGEAdABlAFUAcABkAGEAdABlAFMAZQBhAHIAYwBoAGUAcgAoACkACgAKAHQAcgB5ACAAewAKACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAHMAZQBhAHIAYwBoAGUAcgAuAFMAZQBhAHIAYwBoACgAJwBJAHMASQBuAHMAdABhAGwAbABlAGQAPQAwACAATwBSACAASQBzAEkAbgBzAHQAYQBsAGwAZQBkAD0AMQAnACkACgAgACAAIAAgACQAdQBwAGQAYQB0AGUAcwAgAD0AIABAACgAKQAKAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHUAcABkAGEAdABlACAAaQBuACAAJAByAGUAcwB1AGwAdAAuAFUAcABkAGEAdABlAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGIATgB1AG0AYgBlAHIAcwAgAD0AIABAACgAKQAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAYgAgAGkAbgAgACQAdQBwAGQAYQB0AGUALgBLAEIAQQByAHQAaQBjAGwAZQBJAEQAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAawBiAE4AdQBtAGIAZQByAHMAIAArAD0AIAAnAEsAQgAnACAAKwAgACQAawBiAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAkAGMAdgBlAEkAZABzACAAPQAgAEAAKAApAAoAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwB2AGUAIABpAG4AIAAkAHUAcABkAGEAdABlAC4AQwB2AGUASQBEAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAdgBlAEkAZABzACAAKwA9ACAAJABjAHYAZQAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJABzAGUAdgBlAHIAaQB0AHkAIAA9ACAAJwBVAG4AcwBwAGUAYwBpAGYAaQBlAGQAJwAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAdQBwAGQAYQB0AGUALgBNAHMAcgBjAFMAZQB2AGUAcgBpAHQAeQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwBlAHYAZQByAGkAdAB5ACAAPQAgACQAdQBwAGQAYQB0AGUALgBNAHMAcgBjAFMAZQB2AGUAcgBpAHQAeQAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBUAHkAcABlACAAPQAgACcATwB0AGgAZQByACcACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABjAGEAdAAgAGkAbgAgACQAdQBwAGQAYQB0AGUALgBDAGEAdABlAGcAbwByAGkAZQBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGMAYQB0AC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBTAGUAYwB1AHIAaQB0AHkAJwApACAAewAgACQAdQBwAGQAYQB0AGUAVAB5AHAAZQAgAD0AIAAnAFMAZQBjAHUAcgBpAHQAeQAnADsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAIAAoACQAYwBhAHQALgBOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAEQAZQBmAGkAbgBpAHQAaQBvAG4AJwApACAAewAgACQAdQBwAGQAYQB0AGUAVAB5AHAAZQAgAD0AIAAnAEQAZQBmAGkAbgBpAHQAaQBvAG4AJwA7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACAAKAAkAGMAYQB0AC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBDAHIAaQB0AGkAYwBhAGwAJwApACAAewAgACQAdQBwAGQAYQB0AGUAVAB5AHAAZQAgAD0AIAAnAFMAZQBjAHUAcgBpAHQAeQAnADsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAIAAoACQAYwBhAHQALgBOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAEYAZQBhAHQAdQByAGUAJwApACAAewAgACQAdQBwAGQAYQB0AGUAVAB5AHAAZQAgAD0AIAAnAEYAZQBhAHQAdQByAGUAJwA7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACAAKAAkAGMAYQB0AC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBEAHIAaQB2AGUAcgAnACkAIAB7ACAAJAB1AHAAZABhAHQAZQBUAHkAcABlACAAPQAgACcARAByAGkAdgBlAHIAJwA7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACAAKAAkAGMAYQB0AC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBTAGUAcgB2AGkAYwBlACAAUABhAGMAawAnACkAIAB7ACAAJAB1AHAAZABhAHQAZQBUAHkAcABlACAAPQAgACcAUwBlAHIAdgBpAGMAZQBQAGEAYwBrACcAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABjAGEAdAAuAE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAVQBwAGQAYQB0AGUAIABSAG8AbABsAHUAcAAnACkAIAB7ACAAJAB1AHAAZABhAHQAZQBUAHkAcABlACAAPQAgACcAUgBvAGwAbAB1AHAAJwA7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJABzAHUAcABwAG8AcgB0AFUAcgBsACAAPQAgACcAJwAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAdQBwAGQAYQB0AGUALgBTAHUAcABwAG8AcgB0AFUAcgBsACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHUAcABwAG8AcgB0AFUAcgBsACAAPQAgACQAdQBwAGQAYQB0AGUALgBTAHUAcABwAG8AcgB0AFUAcgBsAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAkAGsAYgBJAGQAIAA9ACAAaQBmACAAKAAkAGsAYgBOAHUAbQBiAGUAcgBzAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAJABrAGIATgB1AG0AYgBlAHIAcwBbADAAXQAgAH0AIABlAGwAcwBlACAAewAgACQAdQBwAGQAYQB0AGUALgBJAGQAZQBuAHQAaQB0AHkALgBVAHAAZABhAHQAZQBJAEQAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJABvAGIAagAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHAAZABhAHQAZQBfAGkAZAAgAD0AIAAkAGsAYgBJAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB3AHUAYQBfAGcAdQBpAGQAIAA9ACAAJAB1AHAAZABhAHQAZQAuAEkAZABlAG4AdABpAHQAeQAuAFUAcABkAGEAdABlAEkARAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAG4AYQBtAGUAIAA9ACAAJAB1AHAAZABhAHQAZQAuAFQAaQB0AGwAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHYAZQByAHMAaQBvAG4AIAA9ACAAJwAnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcwBlAHYAZQByAGkAdAB5ACAAPQAgACQAcwBlAHYAZQByAGkAdAB5AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdQBwAGQAYQB0AGUAXwB0AHkAcABlACAAPQAgACQAdQBwAGQAYQB0AGUAVAB5AHAAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAcwBfAGkAbgBzAHQAYQBsAGwAZQBkACAAPQAgAFsAYgBvAG8AbABdACQAdQBwAGQAYQB0AGUALgBJAHMASQBuAHMAdABhAGwAbABlAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABjAHYAZQBfAGkAZABzACAAPQAgACQAYwB2AGUASQBkAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABzAHUAcABwAG8AcgB0AF8AdQByAGwAIAA9ACAAJABzAHUAcABwAG8AcgB0AFUAcgBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZABlAHMAYwByAGkAcAB0AGkAbwBuACAAPQAgAGkAZgAgACgAJAB1AHAAZABhAHQAZQAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgApACAAewAgACQAdQBwAGQAYQB0AGUALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgAFsATQBhAHQAaABdADoAOgBNAGkAbgAoADUAMAAwACwAIAAkAHUAcABkAGEAdABlAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuAC4ATABlAG4AZwB0AGgAKQApACAAfQAgAGUAbABzAGUAIAB7ACAAJwAnACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAdQBwAGQAYQB0AGUAcwAgACsAPQAgACQAbwBiAGoACgAgACAAIAAgAH0ACgAKACAAIAAgACAAJAB1AHAAZABhAHQAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAnAFsAXQAnAAoAfQAKAA==
    3⤵
    PID:5616

C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process.exe
"C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process.exe" --launch-uac
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6220
- C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process_UAC.exe
  "C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process_UAC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6348

C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe
"C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4216

C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe
"C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4192

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

NetLock_RMM_Agent_Comm.exe

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\Comm Agent\NetLock_RMM_Agent_Comm.exe
Size 29.8MB
SHA256 599b5c40f861fa2cddd19490f28c2e0cee83c588281a80320faa646cba0220f6
MD5 c45f37c015ab126494171dd1a6c475e4
SHA1 4b25ec3a1af7d7c92c4c1abda76e37fe4e90eb55
SHA512 dfa0e38b46ff53f9203e969f300ce5eee5dc20fc9d7ae4d5a1d30803258e3af0cc3333e32c65c37489a27dd6ed0ba1aa1043c59fc694024d2ef26ffa9adad8a9
SSDEEP 393216:9dXH5cpL7Ta6eDTXUdXV3I25g+Qzdl4my2vMkBC4U+0pEJi57kvXPtDqg1SvEVPV:G86s6Xt9lX2kkQ4aCmkvXPtDqaSYn
TLSH
T150670156E2FD00E8D47BC0B8CA574617EBB134551330A7EB26A48A292F37BE56E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetLock_RMM_Agent_Health.exe

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\NetLock_RMM_Agent_Health.exe
Size 13.0MB
SHA256 cc947148aa281b827483f672ade6f8440ea4fe9d1b3e7e1f1e9fd60d966c9810
MD5 d0b3c91594b9ca72e2b7b383ac62f1a6
SHA1 aa505527ccecf5a23e1e14349f1aaa3609622136
SHA512 49517059643c8d781a38ef1464cea2349933660d3ec34ea772a187a878a2415e8ef3ea72ae2efd433079d64e87287cae22f874ee16c85958c719203b08b96187
SSDEEP 393216:AdXH5cpL7Ta6tDTXDQF++qmjgKY9sZdnB2U:R86lDQF77Y98dnB2U
TLSH
T16DD6BF56E2F900E8D47BC0B8C65B4527EBB234551330A7EB16A48A292F37FE56E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

global.json

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\Health Agent\global.json
Size 105B
SHA256 5d60b46e9841b9584e284f16ac318e7d29d16b7cd5387c5686d0da6fb7adbedc
MD5 ad467d069ac1797560e6e967230bf555
SHA1 ab399d8ad91364877f4f6a951b34b48909f43fd1
SHA512 2687dabc88428ca6b6fa5e82ca8d41664c18b5fbe34301e7f642f92313e6f281c599bbf4b3a7e1c4d873db012a2db53a5a870fca0541022704e31fac5a29f0f7
TLSH
T163B01213E2554D7704C02375E0348120D120DB5F2F512D2C32090F9C8F0963D1574688
MD5 SHA1 SHA512 TLSH

Submit Download

NetLock_RMM_Agent_Remote.exe

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\NetLock_RMM_Agent_Remote.exe
Size 16.4MB
SHA256 89db8991015f940887e54c9d7d6af6f957b0cd528d1edfe6eafbcdc030c74ad3
MD5 90ca16ee0f4d29204deff7e6fab02f65
SHA1 87acd140b3d7679b1297be946182c5603933ca21
SHA512 e849d291c459461b0917b7ad3e1b637711a0d3f4592d65335f52e47b13b26d8f91a34dfe0fff19cfc75dbca39ec9dc774e81297cedf666ac547f75fbf2d1ab87
SSDEEP 393216:9dXH5cpL7Ta6qDTXwJgByZgD0roW/NbkYQtkNj:G86IwJgByZi0BNaw
TLSH
T1FD07D056E2F901E8D47BC0B8C65B4527EBB134551330A7EB26A48A292F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsettings.json

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\Remote Agent\appsettings.json
Size 137B
SHA256 ab16b7b75d012475e615a41c21000c9215c6e02cd70b9c2618d25d885aa6ff33
MD5 efb942c8788e089b2e52cbbff0b04b7e
SHA1 8814581ad4a153b4bd347ae8c262da78ed80d58c
SHA512 a3295a7259fc7ec8d35d7cb68c2f535f170c4508d815b8fb5396e45ebe3c674239e2f5be155958b877bf78fd2203daeefc23fe3a6b9d6084d8bcb28d0a3ed511
TLSH
T142C09B54E000485342B55351B5750785FE311DAF0410D58DBF5C3B4C0FEB93702C1F54
MD5 SHA1 SHA512 TLSH

Submit Download

NetLock_RMM_User_Process.exe

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process.exe
Size 14.1MB
SHA256 20ed8858e03a70d83bfad79d1337aa3c88394a42710cd4b7ed55bbce359986fa
MD5 47a79121f3d6f7de04cc60b3f69d0273
SHA1 802d23eb82c90c452b85666a457d6b9795491c4a
SHA512 147447023ad3ac2f823b6e4290d8be94324d04702fb3cc0ebe2fa1d75f5838c66e4b8c2994f495bd6a65be1ab6c9761cf4e69efb84f3ee03dd069f4883d16241
SSDEEP 196608:htidXRR6SWyjwYgk+8o97TdxG6MmDTXR1xUdr9PXuvW3uGnuK6G2OU0zbTE:+dXH5cpL7Ta6VDTXR10r9BuenU0zb4
TLSH
T14AE6CF56E2F900E8D47BC0B8C65B4617EBB234551330A7EB16A48A692F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetLock_RMM_User_Process_UAC.exe

Path C:\Program Files\0x101 Cyber Security\NetLock RMM\User Process\NetLock_RMM_User_Process_UAC.exe
Size 14.1MB
SHA256 cbed67dbfd6fa558eea3930ba67c4b4d91672493be24ee3be628fa6df84784fb
MD5 6d7f3810eddbae6e9d6fc5c424513998
SHA1 3f47310305a8ea82e3b4fa329d553498a0ef9c11
SHA512 9252785e7cdf0dde5cea0cf068f4055e5607b2fcc4635bee47a5454b2b87371af2a7860fc144d3107fe1e8952c4d90eef181f7f3e5192408021543fe9623628f
SSDEEP 196608:/tidXRR6SWyjwYgk+8o97TdxG6E+DTXC1xUdrTOnI7XuvW3uGnuK6G2OU0zbTNc:wdXH5cpL7Ta6VDTXC10rHTBuenU0zbxc
TLSH
T12EE6CF56E2F901E8D47BC0B8C65B4617EBB234551330A7EB16A48A292F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server_config.json

Path C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\server_config.json
Size 590B
SHA256 886ba8ad48773687237074fb4800e3cca395970a4fd1c323eefa27d49558cacd
MD5 181042e35c5e4c05f8a0404a835661f9
SHA1 a2f2761af13335fe77d07cf4453557cf8f038c73
SHA512 17d39a7eca793df4886624d9459c9ddef76ecfb41af7dd5619145eac731a6923f29f7a9878951c9890b7da1122ece69933aebd381a643b67461e1e93d116e7d7
TLSH
T1F5F0CD82890418A727ED6D1D783E590A567A0F3B508B78D8EF13C60B100F62FA1E3DCD
MD5 SHA1 SHA512 TLSH

Submit Download

server_config.json

Path C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\server_config.json
Size 920B
SHA256 0e2d8b1c721ce8f87d62e6b0190f53d7a3609bab7e941067317ccf2559f5d0c8
MD5 1aefccf373a5f37e34c6ca7de6530c4f
SHA1 03f9d3ed654f597ad0092e9a755c5e2a77f0169d
SHA512 b59b7bb923383ba82c0335555c245ff679673575cbce3d1f0b04745a0dc47b0817b0c448579a6f99021c2bd287797cf61d6f25ece8b5cd2fe6486ee2cbf07c8c
TLSH
T1A011C8CF6B352182A03EFD0C496FC1E4E67445556D3538564163A42600B592009B1B61
MD5 SHA1 SHA512 TLSH

Submit Download

server_config.json

Path C:\ProgramData\0x101 Cyber Security\NetLock RMM\Health Agent\server_config.json
Size 609B
SHA256 7922be0755b197d28d5d6203fe59629c9c5eed3ac7416db7adafb272b9899736
MD5 0cc0b8404c01e00803e5dcf36b3d011a
SHA1 c591ab47ad368b4a3f1d08bf769c75855e9a049c
SHA512 de0daeb28cc88c9d1cf76cced7f045c3735963659766721272b876481f2ed11c85a8e79300317f26bcb5a0ad853b730fcee5b0762f76e439d8a5a8b966b35d7e
TLSH
T13BF04F538904182727FDAD1D743D690A757A0B3F516B5CDABE33D646110362EA1C2FCD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a6134e09ef65809adec054f0dad4dd26657dae9361f29e4dd5a2966c35ecf3
MD5 0392ec20508bae8da6ce7b58a8611513
SHA1 567100b8f3a8337f8b34c412ac3975f96be3e22c
SHA512 d9d205fe81fe9bbda38a34ac09d6fb25ad2c61e896b64262e31a1ad001ae6fae86bedae563bbe51ddf449156418d7d9951457181ff77651593aed510939f1abd
TLSH
T1E1E02B6AC8A5EC2B14FD0719A0541782D754135B2B40894F7B3C910C8FF5A374A85C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 eb20fe9c9e1a29b645e913477d4f0834d78cdc3d9baa95f8a2abe4299dfdde95
MD5 6925bef54248457652e28fcf5d965e81
SHA1 ddb867fae7fe9913b60200e635bdb6f5c07623db
SHA512 abe947acda121dc2f9af081eff37e0c61df8eef6d26b7aaf32ff4073ca0f583b5afb08011ba637b6c0e322ac9aa24287dbf25f42103880ee44326d174a070030
TLSH
T1D8B00410D1F40157CF4747F41DF11DD035711D145513171755D3515445777F75501555
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 348c61f23bbdeed9a1b116d59d2c7361b9d0b469602a9b97b239370f482a3530
MD5 c514795ee32d9ffdfd3cf93ae366ffa3
SHA1 0137bc27f4222b2f23c666feda4176e7acfcbb49
SHA512 3b141c25a03650f65b16494dbd876714c1997b7a80812fcd31f8dcfa65059d7df355b18124f40fd7fb569bcfceafd413ee26f76302bf1b4e58a52c21fe624760
TLSH
T1D0618CF7D3E48A7EC91196F4AB246E2FCE6D0914022C3C66C9D4BE5B53E2872D20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 46017e94c668156cd36ac9449bdcea978b71358f787d487f8f68b1990bb25c8f
MD5 9677ec8d904ae212b20173159840904c
SHA1 e421c20495cb082910e3fbdbae39ce0bb05de3e4
SHA512 457ca64b13345e60fe53edbb3847de3fbe843ddd1b4ef85bd404dd24cabf1137c32e43155bfcb305418a1c4271a66df19f67c439428acfc9d76d136d43f2d407
SSDEEP 192:xRVP9vL/HWxvv70IAPRp2dFW9+Hsb+WNnIRmI52ek9KLaeIBVyIsnAUgraJ:xRVP9LEngJXB8wgL239+aNe
TLSH
T14152C52EAA106D7BACDFD229F9617753D7F6502225D52E80E7F88B1C05E76CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ea1c72aa294ad311528c45088027412b74642c810fa51c223aba8857647f6384
MD5 cb92f6b982b0316cf1c35e350444cf6f
SHA1 c63e66dc497a90fb8f9cd2ecfc6499cfae7d1b4f
SHA512 b9d8eb0dda9180db8df3f33d670eecdbaa48feee5cf3ebf26ccee98518eb5daddf37d5f643e0fa67267d7067731587c8b7c05dc94d3b3f3e18ea0e2c96d7d31e
SSDEEP 192:xRVP9vL/HWxRS8v70IAPRp2dFW9+Hsb+WNnIRmkoeeZHk9KLaeIBVyIsnAUgraJ:xRVP9LE0ogJXB8wg7DeZE9+aNe
TLSH
T19E52C52EAA106D7BACDFD229F9617753D7F2502225952E80E7F88B1C05E76CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5186f82ec9c061b390f00d5736222796c416c13f2b4efaa6cc80430000492ad6
MD5 ee8d861d475fce16500389e54e3b1887
SHA1 75a4bcb3d27b9aa54c15f9f5967f10efb4f60092
SHA512 1f4fb42274ebbc0eae9999234a3384cd31f7923ef2d201e3e4875819ff816404efde4ceb99593d312fa4f19873dcd6b573bd4831f67f6a322a446caffc4335ae
SSDEEP 192:xRVP9vL/HWx6v70IgPRpadFW9+Hsb+WNnIRmkoeeZLk9KLaeIPVyIsnAUgraJ:xRVP9LEWgZXV8wg7DeZY9+aXe
TLSH
T17E52C52EAA106D3BACDFD229F9517B53D3F2502125942E84A7FC8B1C09E76CD211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6fae90229661f542312c6436fff847fc05f4a2a61d3c949bfed7c7dc8e371bfc
MD5 e1f4baef911e7239e313de23189b026d
SHA1 d5185c625b317220c1ec4d23ed8da7ce4140a3f5
SHA512 8ad5f270c7e9802e4803287e4b86165537cebed6963a2056b0ef301fc3b445fa8dcaf8a940a344ab3d281d987d32e350130fab6939e3810b38f6f80f9c140546
SSDEEP 192:xRVz9vL/HWx5v70IAPRp2dFW9+Hsb+WNnIRmI52qk9KLaeIXVyIsnAUgtaJ:xRVz9LEZgJXB8wgL2D9+aj8
TLSH
T18E52B52EAA106D7B6CDFC229F9617753D7F6502165992E80E7F88B1C09E76CC312B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f2c6863624a5babb5f47e12b7bf0d01db09e8a998e351bcd7b29ef9254380e15
MD5 4cd184b76ee8863f3729b5f7289b27a1
SHA1 f2093a5ed643b171e00727c35af0e6924c42f83f
SHA512 66629af5065e1c62dba9d5f752fb3b89cbf913371425dbf2b93abee5dc41aca82a43ca6cb343066db3f8af9e4a1881aeabb9cef9a400f3a33333c65d2086f484
SSDEEP 192:xRVz9vL/HW65v70hAPRp2dj9+Hsb+WNnIR0Wk9KLaeIXVyIsnAUgtaJ:xRVz9LRZg8X68wg0f9+aj8
TLSH
T16842C62EAA106D7B6CDFC229FD617753D7F6502125992E84E7F88B1C09E75CC212B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1f0ed4889214d2119c833046c60dde7a7d0b468f67b578ead172ce746b3ac658
MD5 12374df008c6ac935b0e6ca70661601f
SHA1 926ede7accd65a6cea9ecd26bdae0b2ba1ef1823
SHA512 3711920f27b9ee75442f9883b832357c07fda8031a2f0cb0cdf0b6c6255694c021c025032e93c48d0bef9440d79c45bbb27bc1a59b959042ffc1504310a1f1f1
TLSH
T1F5B01200C0016582C04613F0114758C8B21CDF33960E1F0943E07966C829162C025051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ebae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ebae.TMP
Size 96B
SHA256 30728e3ddc9f6b9a8500c489f457ef6ddb7e169bb80487f6bacef5e5ac6d22c5
MD5 618d00464120c02491de0e9271a99086
SHA1 d5ab0f0e9a2fcc91e876bddef8bd9f615dbf1dd8
SHA512 a0161129f13e3d2c624096e7e154e40aaab158fe175ccbcbedb444e294951235ab036b0a0d88fd4c7beb513638bd00c26ad3256365847ead22598c702ed3f1b1
TLSH
T149B0228AC2032202C0020BF0208280CCB020CF20CA03320283E00A23CC28330002A020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 54b7e54441cb87e1b41cb7a6edbca436d36dc84a27ffc036269b445da1b40d06
MD5 99dc15bc697c0850416ec081a9b50de5
SHA1 f24b5caea4d2d919a9fb2c2301ab8400771cea4d
SHA512 f6e9d197c6d6ce5b5c638635e32b7661c411b69b6b05b2a4dc45821101571b10b30a7afa170039608d12814cef48907936a4f6cdfaa2a86dc338e66f86ec3174
SSDEEP 6144:iQOcBIc0OlXQh+EUl8YtZQa3R8yGqZ/ZLW3ExW:VICgoteyGqZ/piQW
TLSH
T1B4341235AFC63E7347EDDFACB1233E999AF908A7983041447A5C7BA72C894E45D8484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 08109f763c410baedf4a9e681e8b53a8fc52fbe51e633f00c79a327b862a5992
MD5 a5846e61c7ec31582f1d68f001d11359
SHA1 34a0b3b7d4c80f886afe17032e15c70eced7d383
SHA512 fe46cfa987ab456658f9ade3530b96c32b2fe7b3812b8c2337d1f6fc46ea1aa329e20c7d119312443f36f8fd26e3aa10d73353045ad2176369611805d5066c2d
SSDEEP 6144:nOcBIc0OlXQh+EUl8YtZQa3R8yGqZ/ZLW3ExW:TICgoteyGqZ/piQW
TLSH
T1F9342235ABC63E334ADDDB7CB1233E99A7F908A3647041407B6CBBAB6D858E4598444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6b57667bbf96327e7afdc87ab153f3951767f03a44722b38d436c3bb76925afb
MD5 99c1d09afade51c6b1dcbcdb8609953f
SHA1 cf1529ac800c78b9be99d9951b888dd3d30f4264
SHA512 a4ccded175dfbf329719f04812fb0f647a9fc5f41fffb3a3ffb758335501b6729d4b5129edb97b8c9e183e7605c6d63787937ba9ab5ba44410a6d886dec4804d
SSDEEP 1536:bcmLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:5qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1B9C30237ABC21F379D93CF64B9130FD6A7B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f333bff4c4138d69c58259df6b4d836263310721cd31827439d2dac5265722d3
MD5 86389192e500fca0e498206540375216
SHA1 7ba8630ec5c442f85c21fb1d086ccad76bd634b4
SHA512 c39aa65ae3ea78f38c6bc95e2f9d1aa13b7dcc7195963ae76931210c38a8cbbd496c5feb427ce5a4146752a9ec203475387e2d53c2183130361adb5492ef49fd
SSDEEP 6144:gOcBIc0OlXQh+EUl8YtZQa3R8yGqZ/ZLW3ExW:GICgoteyGqZ/piQW
TLSH
T123342235ABC63E334AEDDB7CB1233E99A7F908A3647041407B6C7BAB6DC58E4598444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753\gPlBWnMBgxna\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753\gPlBWnMBgxna\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
MD5 fdfc5facbb8d7ed52bcfeda911586cd6
SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
TLSH
T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IRS_Transcript_EFIN_VIEWER-5861753_90432-2025_-5861753\gPlBWnMBgxna\libSkiaSharp.dll
Size 11.1MB
SHA256 6d6eca64ec333daed78858a637b54c545aa01558204b8e2ae8870692acada127
MD5 9f1deaee40e34c7c08952a3e5ebb3ca6
SHA1 36f50165a5688289bb3877b8f29a354c4d5fd458
SHA512 a5c9178ac02cda3feee7f8e1f26dce5cae247e6bb38ba596fc843d985636dc53a08cf20c9e3f4a8c542864f9dbb1d1d9f02cb7b9e879bbbd622219962df60a53
SSDEEP 98304:61DvlpF6Tf9V805SPZYjyPytfdn93P8bZaFcbNB/ezHL84dYTFffN6G:61DATjy6d38ZaFcbMn6TFfff
TLSH
T114C64B067A5A54ADC48AC4B4934B4967AD2034CB0B35BCEF41C596393FBABF42F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDB496.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 5149273d7de2a4af97c0e0664626288858019fd0ab586a753656e81167ec080f
MD5 f84d44093e7c1f64587485db1d535e20
SHA1 39fffade5cf36d12fe2b87ad41952b096e03e99b
SHA512 0835cc1671c4aaeeff7ed22312fe082ee75aca2ece59351ff7a5abf9814ab23e063b41a6868a8d5039b3d478a51f84660232a5107ffe9633707c13b53240cbb5
TLSH
T19451FF0163DB2F4FE0A0C337923A5756DB303C83EA67970FA684215E5D75E005F5DA2A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 868953.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 868953.crdownload
Size 23.5MB
SHA256 30828b38700fafc6b29bee79387e1bd913d1e5714a1dc06c2184696a97b11a85
MD5 7e51cfd30fb6d05c70e9fc9fc2505daf
SHA1 eb92653223ca2efd3d595bd0d3dfba6547bc96e7
SHA512 232706a497f7aed258174a6ee226d7623aeac476c7027842b92a7c00a5146845ee9fc79dcc94892ed7a69d6900bd067752c11b79ef5279529927aec90f9bfb68
SSDEEP 393216:ddXH5cpL7Ta69DTX/a6bXmirK8bMHbaSh1vwpHoreUMCU/my+HHRh1A+/Y6:m861/a6TfqHGSnwqMC6+Hxh1Ld
TLSH
T13647F156E2F900E8D47BC0B8C65B5627EBB234551330A7EB16A48A252F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.dll

Path C:\Windows\Temp\.net\NetLock_RMM_Agent_Comm\yy0l2ywg.1zh\e_sqlite3.dll
Size 1.7MB
SHA256 4dcbb2ad197d893355efa004257e048f2c850feb1078158f4baab0f7b53ac45f
MD5 112b1b7788e602229ee3ccff14f9936e
SHA1 8c672384c19f3c226e59d5da2a1073afc0b85a7a
SHA512 520ff432de7ac7cfa9d36c69bcc4b59f588fdd33b53312cb2cfdc2ae3fc7fcef737d1af8c0b0f8cc85235616aa2223611211d4fdea2eafb61fc543baa7bb4c3f
SSDEEP 24576:D0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wY:DF9LAKCk8tTEHE3YcviCaTpmvHQThB5
TLSH
T1B6857D4BB2B900ACD8A782B8C517570BD7F274151764ABDB15908AA52F23FF61F7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o1yj5rl3.zey.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_o1yj5rl3.zey.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3924113f27f3ad2ebe752cf27a50523b9f05382776f88ad4c6172df175bd25a3
MD5 53169e560f94b03247bdd6bd752445e1
SHA1 b6efc96de828a2bb21d659e3fcbc16a871ba5e71
SHA512 9d9250339f36c1584090cb58df895e81d8344c1133f659c416d4eb3e0f68214c5aafec75257e1643127cd69a94c854903f2719ba5b5bf83fd16ee3a261d8c334
TLSH
T18B81FE323375B0D4C9567F062A2819D063BF4386EA98AF4CB25C621EDD2640BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 22074d71dbf4636080ee3b4af53612f2f1c6b0fd1dfb2e18893d267e60f3d06d
MD5 96e66c6151c6ef0aa0810f6b2896f65b
SHA1 0191114d00782a6fe104cb07f1797238ee5e0136
SHA512 e7999e91eafe60a06366ec10565265f5517fd5f8f5fceb2ef86816752b6ed1700c80a49babd84e1beab63413e71a8637174438a4dfe6f0bcc846641d83fad982
TLSH
T16C219727B3DC8921DCD5163A509D9C1036AA83C7849EDF9B6BC0D324957FAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-753-0x00000290C5EF0000-0x00000290C5F0A000-memory.dmp

Download

memory/1848-752-0x00000290C5E90000-0x00000290C5E9E000-memory.dmp

Download

memory/1848-751-0x00000290C5EB0000-0x00000290C5ECC000-memory.dmp

Download

memory/1848-750-0x00000290C5C60000-0x00000290C5C6A000-memory.dmp

Download

memory/1848-749-0x00000290C5C90000-0x00000290C5D45000-memory.dmp

Download

memory/1848-748-0x00000290C5C70000-0x00000290C5C8C000-memory.dmp

Download

memory/1848-728-0x00000290C58A0000-0x00000290C58C2000-memory.dmp

Download

memory/3872-7-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-9-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-2-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-6-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-4-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-8-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-0-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-1-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-11-0x00007FFB9D530000-0x00007FFB9D540000-memory.dmp

Download

memory/3872-5-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-10-0x00007FFB9D530000-0x00007FFB9D540000-memory.dmp

Download

memory/3872-3-0x00007FFBDF5AD000-0x00007FFBDF5AE000-memory.dmp

Download

memory/3872-23-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-24-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download