62cd3e4fac5039ae912ab886eab9921152a6a07801829add67053b56a40f794a

Analysis

user interaction
yes
max time kernel
359s
max time network
364s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/07/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8o6MCoJwdRwT.exe
Size 11.2MB
Sample260728-gvb3yack71
SHA256 62cd3e4fac5039ae912ab886eab9921152a6a07801829add67053b56a40f794a
MD5 74a59a1bf55b071a9d8ea30825b0fb09
SHA1 205c7e8147278f5fe6067c594b1517a1cb2b1212
SHA512 6af52186c6772a6dc4dfe0f4f2fa8505d5fe733e21701e624b130b98936e54db22bb171f6a30a4f75a5067bdf1f015d5035e623960a26a67007a463a55397ae4
SSDEEP 196608:KoIL8bQeBk78Y6QN5ILCRVK3WHe5P+3horw4SdFx+MCiAFOKAyVrqNNgtsuULdol:KoIoGVTN5wCnoP+3h1CiVKAykNgtsuWG
TLSH
T19AC633EA6148331CC01EC5B0A433BD05B1F6531E4AD9D96BF6D7BAD077EE861DA02B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	4680	chrome.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\spaceportx.sys	perfmon.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3172	netsh.exe
1948	netsh.exe
1752	netsh.exe
1164	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\spaceportx\ImagePath = "System32\\drivers\\spaceportx.sys"	perfmon.exe

Deletes itself 1 IoCs

pid	Process
3808	perfmon.exe

Executes dropped EXE 1 IoCs

pid	Process
4980	iii6YXY0ma59.com

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4028	8o6MCoJwdRwT.exe
3808	perfmon.exe
4980	iii6YXY0ma59.com
5348	perfmon.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 3808	4028	8o6MCoJwdRwT.exe	80
PID 4980 set thread context of 5348	4980	iii6YXY0ma59.com	932

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4088	sc.exe
3396	sc.exe
5524	sc.exe
5988	sc.exe
1620	sc.exe
3016	sc.exe
1692	sc.exe
1976	sc.exe
3260	sc.exe
3312	sc.exe
5632	sc.exe
3440	sc.exe
2828	sc.exe
4928	sc.exe
2752	sc.exe
892	sc.exe
3340	sc.exe
4132	sc.exe
2088	sc.exe
3212	sc.exe
1988	sc.exe
6048	sc.exe
4912	sc.exe
4388	sc.exe
5156	sc.exe
3224	sc.exe
2980	sc.exe
1816	sc.exe
5692	sc.exe
2192	sc.exe
3544	sc.exe
2744	sc.exe
5564	sc.exe
4396	sc.exe
4544	sc.exe
4292	sc.exe
1548	sc.exe
1276	sc.exe
2372	sc.exe
4748	sc.exe
4764	sc.exe
2108	sc.exe
5108	sc.exe
2752	sc.exe
4180	sc.exe
1496	sc.exe
4144	sc.exe
4144	sc.exe
1108	sc.exe
5888	sc.exe
2060	sc.exe
3452	sc.exe
3532	sc.exe
4396	sc.exe
5228	sc.exe
5024	sc.exe
5108	sc.exe
1700	sc.exe
3532	sc.exe
8	sc.exe
5080	sc.exe
1240	sc.exe
1632	sc.exe
5112	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4460	powershell.exe
4128	powershell.exe
6040	powershell.exe
2188	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3976	SystemSettingsAdminFlows.exe
4680	chrome.exe
2664	SystemSettingsAdminFlows.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5192	ipconfig.exe
5488	ipconfig.exe
4852	ipconfig.exe
4308	ipconfig.exe
4988	ipconfig.exe
1088	ipconfig.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4744	taskkill.exe
4340	taskkill.exe
5860	taskkill.exe
3168	taskkill.exe
2192	taskkill.exe
5216	taskkill.exe
2948	taskkill.exe
1228	taskkill.exe
4256	taskkill.exe
2436	taskkill.exe
4340	taskkill.exe
240	taskkill.exe
3788	taskkill.exe
5172	taskkill.exe
4880	taskkill.exe
1232	taskkill.exe
5040	taskkill.exe
2492	taskkill.exe
4424	taskkill.exe
4500	taskkill.exe
3440	taskkill.exe
3924	taskkill.exe
1068	taskkill.exe
3868	taskkill.exe
6084	taskkill.exe
5688	taskkill.exe
5128	taskkill.exe
4764	taskkill.exe
4820	taskkill.exe
5432	taskkill.exe
3788	taskkill.exe
1228	taskkill.exe
2108	taskkill.exe
2728	taskkill.exe
4716	taskkill.exe
3472	taskkill.exe
1284	taskkill.exe
3276	taskkill.exe
5608	taskkill.exe
6036	taskkill.exe
756	taskkill.exe
3872	taskkill.exe
3964	taskkill.exe
5788	taskkill.exe
928	taskkill.exe
5400	taskkill.exe
2088	taskkill.exe
4088	taskkill.exe
5188	taskkill.exe
5704	taskkill.exe
3316	taskkill.exe
4412	taskkill.exe
3832	taskkill.exe
3092	taskkill.exe
4340	taskkill.exe
1172	taskkill.exe
4548	taskkill.exe
5192	taskkill.exe
5344	taskkill.exe
2208	taskkill.exe
4672	taskkill.exe
5108	taskkill.exe
5972	taskkill.exe
4820	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296924575835245"	chrome.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\iii6YXY0ma59.com:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4028	8o6MCoJwdRwT.exe
4028	8o6MCoJwdRwT.exe
4336	chrome.exe
4336	chrome.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe
3808	perfmon.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
3808	perfmon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeDebugPrivilege	3808	perfmon.exe
Token: SeTakeOwnershipPrivilege	3808	perfmon.exe
Token: SeLoadDriverPrivilege	3808	perfmon.exe
Token: SeShutdownPrivilege	3808	perfmon.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeDebugPrivilege	3260	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeIncreaseQuotaPrivilege	4460	powershell.exe
Token: SeSecurityPrivilege	4460	powershell.exe
Token: SeTakeOwnershipPrivilege	4460	powershell.exe
Token: SeLoadDriverPrivilege	4460	powershell.exe
Token: SeSystemProfilePrivilege	4460	powershell.exe
Token: SeSystemtimePrivilege	4460	powershell.exe
Token: SeProfSingleProcessPrivilege	4460	powershell.exe
Token: SeIncBasePriorityPrivilege	4460	powershell.exe
Token: SeCreatePagefilePrivilege	4460	powershell.exe
Token: SeBackupPrivilege	4460	powershell.exe
Token: SeRestorePrivilege	4460	powershell.exe
Token: SeShutdownPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeSystemEnvironmentPrivilege	4460	powershell.exe
Token: SeRemoteShutdownPrivilege	4460	powershell.exe
Token: SeUndockPrivilege	4460	powershell.exe
Token: SeManageVolumePrivilege	4460	powershell.exe
Token: 33	4460	powershell.exe
Token: 34	4460	powershell.exe
Token: 35	4460	powershell.exe
Token: 36	4460	powershell.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
1248	RunDll32.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
5648	RunDll32.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3808	4028	8o6MCoJwdRwT.exe	80
PID 4028 wrote to memory of 3808	4028	8o6MCoJwdRwT.exe	80
PID 4028 wrote to memory of 3808	4028	8o6MCoJwdRwT.exe	80
PID 4028 wrote to memory of 3808	4028	8o6MCoJwdRwT.exe	80
PID 4336 wrote to memory of 5708	4336	chrome.exe	82
PID 4336 wrote to memory of 3000	4336	chrome.exe	83
PID 4336 wrote to memory of 3000	4336	chrome.exe	83
PID 4336 wrote to memory of 4680	4336	chrome.exe	84
PID 4336 wrote to memory of 5528	4336	chrome.exe	86
PID 4336 wrote to memory of 5528	4336	chrome.exe	86
PID 4336 wrote to memory of 4040	4336	chrome.exe	87
PID 4336 wrote to memory of 4040	4336	chrome.exe	87
PID 4336 wrote to memory of 1496	4336	chrome.exe	88
PID 4336 wrote to memory of 1496	4336	chrome.exe	88
PID 4336 wrote to memory of 5932	4336	chrome.exe	89
PID 4336 wrote to memory of 5932	4336	chrome.exe	89
PID 4336 wrote to memory of 5476	4336	chrome.exe	91
PID 4336 wrote to memory of 5476	4336	chrome.exe	91
PID 3808 wrote to memory of 2664	3808	perfmon.exe	92
PID 3808 wrote to memory of 3884	3808	perfmon.exe	93
PID 3808 wrote to memory of 3172	3808	perfmon.exe	155
PID 3808 wrote to memory of 2112	3808	perfmon.exe	213
PID 3808 wrote to memory of 1692	3808	perfmon.exe	160
PID 3808 wrote to memory of 3084	3808	perfmon.exe	101
PID 3808 wrote to memory of 1112	3808	perfmon.exe	103
PID 3808 wrote to memory of 3440	3808	perfmon.exe	105
PID 4336 wrote to memory of 1016	4336	chrome.exe	107
PID 4336 wrote to memory of 1016	4336	chrome.exe	107
PID 3808 wrote to memory of 3260	3808	perfmon.exe	170
PID 3808 wrote to memory of 3504	3808	perfmon.exe	110
PID 3808 wrote to memory of 1276	3808	perfmon.exe	112
PID 3808 wrote to memory of 2260	3808	perfmon.exe	114
PID 4336 wrote to memory of 2576	4336	chrome.exe	116
PID 4336 wrote to memory of 2576	4336	chrome.exe	116
PID 3808 wrote to memory of 128	3808	perfmon.exe	117
PID 3808 wrote to memory of 3840	3808	perfmon.exe	119
PID 3808 wrote to memory of 4400	3808	perfmon.exe	121
PID 3808 wrote to memory of 1828	3808	perfmon.exe	123
PID 3808 wrote to memory of 3224	3808	perfmon.exe	125
PID 3808 wrote to memory of 4936	3808	perfmon.exe	127
PID 4336 wrote to memory of 4952	4336	chrome.exe	129
PID 3808 wrote to memory of 5080	3808	perfmon.exe	130
PID 3808 wrote to memory of 4812	3808	perfmon.exe	133
PID 3808 wrote to memory of 3532	3808	perfmon.exe	135
PID 3808 wrote to memory of 5192	3808	perfmon.exe	137
PID 3808 wrote to memory of 2220	3808	perfmon.exe	191
PID 3808 wrote to memory of 4864	3808	perfmon.exe	141
PID 4336 wrote to memory of 1612	4336	chrome.exe	143
PID 4336 wrote to memory of 1612	4336	chrome.exe	143
PID 3808 wrote to memory of 4004	3808	perfmon.exe	144
PID 4336 wrote to memory of 3028	4336	chrome.exe	146
PID 4336 wrote to memory of 3028	4336	chrome.exe	146
PID 3808 wrote to memory of 2348	3808	perfmon.exe	147
PID 3808 wrote to memory of 3012	3808	perfmon.exe	149
PID 3808 wrote to memory of 2776	3808	perfmon.exe	151
PID 3808 wrote to memory of 3472	3808	perfmon.exe	153
PID 3808 wrote to memory of 3172	3808	perfmon.exe	282
PID 3808 wrote to memory of 1640	3808	perfmon.exe	157
PID 3808 wrote to memory of 4872	3808	perfmon.exe	159
PID 3808 wrote to memory of 5248	3808	perfmon.exe	161
PID 3808 wrote to memory of 892	3808	perfmon.exe	163
PID 3808 wrote to memory of 2980	3808	perfmon.exe	165
PID 3808 wrote to memory of 3824	3808	perfmon.exe	284
PID 3808 wrote to memory of 4460	3808	perfmon.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8o6MCoJwdRwT.exe
"C:\Users\Admin\AppData\Local\Temp\8o6MCoJwdRwT.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SYSTEM32\perfmon.exe
  perfmon.exe "C:\Users\Admin\AppData\Local\Temp\8o6MCoJwdRwT.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Deletes itself
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SYSTEM32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:2664
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:3884
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    - Launches sc.exe
    PID:1276
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:128
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:3840
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:1828
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3224
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:5080
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:4812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\SYSTEM32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4864
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule name=all program="C:\Users\Admin\AppData\Local\Temp\8o6MCoJwdRwT.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3172
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:1640
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:5248
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:892
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:2980
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:3824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*8o6mcojwdrwt*' } | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3260
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:1988
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:3452
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:5320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:2696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5652
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2220
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:3836
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3788
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5992
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:3396
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:1340
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:6056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2112
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5488
- - C:\Windows\SYSTEM32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5612
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule name=all program="C:\Windows\SYSTEM32\perfmon.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*perfmon*' } | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4128
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:1240
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:1232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:1616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:2904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:2940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3452
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:4176
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:3932
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4000
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:2696
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5560
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:232
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:5028
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:3872
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4744
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    - Launches sc.exe
    PID:6048
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5004
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:5488
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:3992
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3172
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:3544
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3824
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:3340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1948
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2384
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:1672
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:6004
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:6084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1240
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:5344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:3640
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:5328
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:1344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5320
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:5700
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4176
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:4088
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:1168
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:4828
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2744
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /f /v FeatureSettingsOverride /t REG_DWORD /d 3
    3⤵
    PID:1000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:232
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /f /v FeatureSettingsOverrideMask /t REG_DWORD /d 3
    3⤵
    PID:5964
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /f /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0
    3⤵
    PID:5028
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2388
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:4332
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:5620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:4216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4744
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:4844
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4376
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:1644
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:5564
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5376
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:1056
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2752
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:1340
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:5500
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:1816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:3964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:4984
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5516
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:5080
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:988
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:3532
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:4396
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:1620
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2164
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:3868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:2124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1472
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2112
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:2980
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:1692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4844
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5224
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5612
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3544
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:1560
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:3340
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:4180
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:5500
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:2172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1796
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4540
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4424
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:464
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:3452
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:1632
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4088
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:3168
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:4396
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:2828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:6080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:2164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:1992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3868
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4976
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4740
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2124
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:1612
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:4144
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:412
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:1356
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:4008
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:4848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5860
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:2440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:4180
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4672
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1816
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2692
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    - Launches sc.exe
    PID:1976
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:1744
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4860
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5536
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2576
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:4980
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2816
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:5156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:1824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:3348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5468
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:2388
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:4132
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:1700
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:3868
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5636
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:5400
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:4748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:2740
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:2188
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:3340
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    - Launches sc.exe
    PID:5228
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:6084
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:1224
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:1008
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:1276
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:4764
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:3964
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:4836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3168
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1756
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:5024
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:3080
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5188
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:928
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:2108
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:1700
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5400
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:2248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:1112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:876
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2460
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:3212
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:3216
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:3340
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:4668
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5228
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:132
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:4912
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:2316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:4764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2492
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:3760
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5700
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4880
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4828
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:2760
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:3532
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:4032
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:5640
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5356
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4820
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4736
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:1512
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:6056
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:3712
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:6008
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:4848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:1948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:6084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2728
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:1712
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    - Launches sc.exe
    PID:4544
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:5344
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5180
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5316
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:3016
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:3452
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:5692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:5340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:6108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:3532
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5216
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:240
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3556
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:1748
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:5524
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:1412
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:4388
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:3228
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3260
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:4820
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:2112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:5372
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    - Launches sc.exe
    PID:2372
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5244
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4668
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:132
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:3312
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2004
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2640
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:4460
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:2100
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4500
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:1940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5688
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:2276
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5988
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:4928
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:4292
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:2696
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5496
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5664
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:5168
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:1108
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:4552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:4452
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:4308
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:5176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:5740
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:1840
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:1172
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:2112
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:2740
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:1548
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4852
- - C:\Windows\SYSTEM32\RunDll32.exe
    RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    PID:1248
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
      4⤵
      Modifies registry class
      PID:2436
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    - Launches sc.exe
    PID:2752
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    - Launches sc.exe
    PID:2088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1224
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:5552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffccef2c728,0x7ffccef2c734,0x7ffccef2c740
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,11494574972960519347,13131621580576825609,262144 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,13855188950528137543,14109544631928706001,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17028414394689065381,8352404165764646508,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,816456474317472836,3662351469359721654,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,18097421185563600581,9874692431547987011,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,5185112115031249281,7009428253706434530,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,7031987629034521327,6893547006241344442,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5696,i,253217468358571066,12164313102998680149,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4656,i,3297528800951219085,5914483498595546470,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,11146927325190364306,11289787411586614288,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4700,i,16501922436430045571,1732837868230998329,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5992,i,15316777561538771373,12204402199875649702,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,14652821662821882720,6090351655190815154,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,9222739574598820089,2015826453532309014,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,14282169797478921203,16282775815708885166,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5880,i,11803989691537819748,11401575640485251975,2097152 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5712,i,8506068290770590621,8584930861734890921,262144 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:10
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,14650144557578502313,11710334071994843902,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,6988823713318246699,16862729161275347750,524288 --field-trial-handle=1932,i,12790932851537419305,14165240541543295453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:1716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3816

C:\Users\Admin\Downloads\iii6YXY0ma59.com
"C:\Users\Admin\Downloads\iii6YXY0ma59.com"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:4980
- C:\Windows\SYSTEM32\perfmon.exe
  perfmon.exe "C:\Users\Admin\Downloads\iii6YXY0ma59.com"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5348
- - C:\Windows\SYSTEM32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:3976
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:4540
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:1732
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5188
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:3508
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4308
- - C:\Windows\SYSTEM32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2288
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3440
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2776
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:5888
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:5108
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:4144
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:5632
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2636
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:1496
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule name=all program="C:\Users\Admin\Downloads\iii6YXY0ma59.com"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1752
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:3696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*iii6yxy0ma59.com*' } | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:2416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4716
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3272
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:4732
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:3816
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:2060
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    - Launches sc.exe
    PID:5988
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5456
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2744
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:3276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:3104
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:4308
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:1144
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5608
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    - Launches sc.exe
    PID:3440
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5596
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:1952
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    - Launches sc.exe
    PID:8
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5360
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5372
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5488
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    - Launches sc.exe
    PID:3212
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4988
- - C:\Windows\SYSTEM32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3868
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule name=all program="C:\Windows\SYSTEM32\perfmon.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1164
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*perfmon*' } | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:248
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:2244
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2088
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:1264
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:3476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:6036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:3272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:5044
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:3288
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    PID:5984
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    PID:3976
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:4056
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:2192
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:5020
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:3576
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:3024
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:4396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4820
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vkg
    3⤵
    PID:2112
- - C:\Windows\SYSTEM32\sc.exe
    sc stop FaceIT
    3⤵
    - Launches sc.exe
    PID:5112
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEService
    3⤵
    - Launches sc.exe
    PID:5108
- - C:\Windows\SYSTEM32\sc.exe
    sc stop BEDaisy
    3⤵
    PID:5360
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    PID:5404
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5372
- - C:\Windows\SYSTEM32\sc.exe
    sc stop EasyAntiCheatSys
    3⤵
    PID:960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5488
- - C:\Windows\SYSTEM32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:5096
- - C:\Windows\SYSTEM32\sc.exe
    sc stop atvi-brynhildr
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1088
- - C:\Windows\SYSTEM32\RunDll32.exe
    RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    PID:5648
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
      4⤵
      Modifies registry class
      PID:2832
- - C:\Windows\SYSTEM32\sc.exe
    sc start ProfSvc
    3⤵
    PID:3340
- - C:\Windows\SYSTEM32\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:1904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24b5f935527b7e2c7ae091d04e37bc3f106a1fb316f5d3c28733af60dd72bfc3
MD5 44f39f1bcd3564dfc8d7e5b2d3ac7565
SHA1 6955c65529a42672bfd9541439b3dc59f6fa705b
SHA512 21cf3f00aaf5fbd87d34450292662664cc1940a2fd8cb5f4ce2c8c069f86b108de07417e4dbd0309d8dcdf51edb591f79412c3d55d132cef49d081ba465069cf
TLSH
T1F5E02BAACD24DC7715FC071860545647EB4417563B50485F7A3C954C8FB4737878685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 ec626d4e69be2398777b91a6c1eecfb357e0e5cb36a4d2132991b504cf2f3820
MD5 b361b9c646011b9dbfdca7f8b6055a4b
SHA1 30b767ae85fa806b0e56267e75af51c5f011e47b
SHA512 dae3f32a8c583c21915cdacc34d6bfa2cabcbbece8305cb7b1f18b89966ca4851956542385df8de272b8bdae45ed8761731de694e3880f03dd374df97eda56d0
TLSH
T183D0A99C65A8288CC7284EB0A8FD906DFCFCDA4804079EC5C3CD0AB3B050328818C603
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 686abdaf7fdfc7c83f2713bf971edaf8a572fc48ca56864ce95738488827f91f
MD5 d6a7f649763f80274ee3a7dac326cbd8
SHA1 ac24cd89c3a1c16cc49f13a6ecc9a3617611d996
SHA512 849e44a627914325fc125607e421f0be4d98016754f0b61043074c451fca8d87d1d958d5239ab83688d703860c12b40fd83924ab9f6f38c63b4286ecfdadd2d1
SSDEEP 48:YALlCvCCv6CgSj2ihZCvXCvEPgyxzaXYfo7dKsn4sCCZsifsuC3sMCAsS+szrCHP:Dz9ob3GJDaIad1Cgz6ntsmOje6
TLSH
T1DAA1BEF7C7E88A6DC91152F0AB143E2BCE690915436C3C5AC9D8AF4FA7E2571D24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2f625e5b156d10754d917ec5dcafff98b17c9d6b435520c304168d4b7cab4e96
MD5 34af6c0ed0ab3c50d67a567fa85c040c
SHA1 de921b4dfb6ed6e8b839841e811a660c7b9db9c9
SHA512 99c4ee9b6832cff208de777e3f950454282609f20c7f4d41c9163e819b2fc39881601ec3d6ddd747f4b0ee0d10aaecdc706a6281da40f36fb483c4cb115ddd6b
SSDEEP 48:YALlCvCCv6CgSj2ihZCvXCvEPgyxzaXYfo7dKsn4sifsuC3sMCAszrCHsCCAzsPy:Dz9ob3GJDaIad1iz6CsmOjdJ12wPg6
TLSH
T1CDB1BFF7C7E88A6DC91152F0AB143E2BCE690915436C3C5AC9D8AF4F67E2472D25064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 24f8077347b154ae77bead48ef212c97220b5a6df64e4b95289ee035854b3201
MD5 eba153365c4494b535f34815021b23b9
SHA1 008e63bb0e3690917a18c84be62142005841c430
SHA512 5c2507a3cac4b49fdef398d6b0aad973c91ef3a5efcef1b2aae8403256d11774544eac544b800ab410da51bb8497dcb88ba4921aca1785508ad6a77fedde0777
SSDEEP 48:YALlCvCCv6CgSj2ihZCvXCvEPgyxPqYaXYfo7dKsn4sifsuC3sMCAsCCAzsPgmz5:Dz9ob3GJfnaIad1iz67mOjdXPq/u1BK
TLSH
T196B1CFF7C7E88A6DC91152F0AB143E2BCE690915436C3C5ACDD8AF4FA7E2472D24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 704ed4e8e1a45b8ab0a6cf8346491b7e2d41f53cc17b0fb843864d86df5f5a2d
MD5 630a4d3c576bcf0a8888d995df69e560
SHA1 ed60488cbee3522e06a8a4cb97b5bd0d999a995c
SHA512 bd9a0c46e1c4d28d497cc72538db53b2c9bf4aae2fbd9d1e29e01fcf91366312ab22c80662588c0cd5ef0927fc583af11207a1b68bfebed279625d56214530c0
SSDEEP 192:gRUf2TBdMEzbTv7+pYPRp5c6M9wHsb+WNnfoorwsJn0kwWaQGi8yIsnAUgraJ:gRUfM1br68XQOwwjs62ate
TLSH
T1FA52E82EB950653B5DCAD72DFA11BB63D7F4203562941E44E6FC8E1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63e209ee69cbd121dfecc5956b8497ac21c04990a31484089a93398cd7670204
MD5 36c7a5393b26f76f980f610a866be29d
SHA1 bfc56e82b4bc7b04bcae0d220e96154a106da707
SHA512 ff4484f3ee55cb16914ad675262deddd1f130b6c53cf846f9b43b465e564373f9bbbe3876ca54126639c7a3a3ad28ea14b445f172e3bde490f897b6591676327
SSDEEP 192:gRUf2TBdMEzbiv7+pAPRpVc6M9wHsb+WNnfoopGuBn0kwWaQAi8yIsnAUgraJ:gRUfM1bu6UXUOww9uC2aBe
TLSH
T1E152E82EB910653B5DCAD72DFA25B763D7F5103562941E84E6FC8E1C28E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 950a64b2bd1bb3158aa5fe669a9199036ed7b291808e618c5360b660500f001d
MD5 327d0fb3e8f0203d0809bba749073639
SHA1 ac6661bd99d4b0daedc2d4a375d7a00ab99b2187
SHA512 295e6d81d14ccd0090d1f45d2d7c0460190d898f7b12e8bc6e096a3c2c6dfca75bb69bd51b95c4adec65aa5c61cfe3996f85e797c4822514222162f2bcc50cf7
SSDEEP 192:gRUr2TBdMEzbhGv7+pAPRp2cV9wHsb+WNnRe0Nn0kwWaQFiVyIsnAUgtaJ:gRUrM1bhy6UXVOww0O2aZ8
TLSH
T11842F82EBA50653B5DCBC729FA25BB53D7F5103521981E84E6FC8A2C19E75CC222702F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2f217225aa3a3ce48472afd634aee30f715d7bb625780d274b73027094221b2e
MD5 11bf4bcb32d3b3b4f788ce4919ce647f
SHA1 551f8e5dccfd75e43ac1dbb8197a267720ea244d
SHA512 ff37451e9df8fa450bb44b988b4ceed6f4df3c811b66aa444a5b52ae8d8f5f9f1067852ba24a8aaecab4d5e07058ed0af405c10b494d108eb767107b4338ac39
SSDEEP 192:gRUMATBdMEzbIv7+pYPRp5c6M9wHsb+WNnfoo+N02n0kwWaQGi8yIsnAUgraJ:gRUMK1bU68XQOwwz0H2ate
TLSH
T12A52F82EB910693B6DCBD72DFA11BB63D7F5203562941E44E6FC8A1C29E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cee46ee88d259dc95580c6f1ecabcf6674f016c38dd48cd6f6a8af5f2f394734
MD5 2c6fc09a2df9c3241fd1df5749bde060
SHA1 1029876f2032d3a4579998c375e2aa5bd21621d8
SHA512 313f441be0c6f5838ef350e55e2fe623286bb6fef4654e9a47ea8c9937bb75a4ca11199b88f89a96fc33054ba5c49ff8793296d0d9d8d08550a55da667847784
SSDEEP 192:gRUfATBdMEzbTv7+pYPRp5c6M9wHsb+WNnfoo+N02n0kwWaQGi8yIsnAUgraJ:gRUfK1br68XQOwwz0H2ate
TLSH
T1A252F82EB910693B6DCAD72DFA11BB63DBF5203562941E44E7FC8A1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cd3e8ccb99cfeee5bba7509f52ab328d94365c7f2d3e6ad4dda1028823f1ff23
MD5 c3dfeec30c7f295bf03b17d69571e9bb
SHA1 ba9d712142999b2317467d80f7476775cbed7416
SHA512 fbc7b44225b548c1a84a58017964db1621fb3a905bcbeb5011e3de960330cd43b967d86954c17ee8c240443a3464ac7ed3bf52ca5ee4ca34ea7f60c8cfc04752
SSDEEP 192:gRUfATBdMEzbIv7+pYPRp5c6M9wHsb+WNnfoo+N02n0kwWaQGi8yIsnAUgraJ:gRUfK1bU68XQOwwz0H2ate
TLSH
T12552F82EB91069375DCBD72DFA11BB63D7F5203562941E44E6FC8A1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 50f05909fa912b218b6b74e19e8fbe3cd9d43fa33319f6de3e16fde4474f4fbf
MD5 fdcce29b8303dce37ccbb5837d273202
SHA1 fa7f2d445d6ed039e8f0e06755338da3e4f26799
SHA512 c4372ed543ca51aa1e551425332d0ea89d5ad88ae162b858eb775eb94ff1ed39c9ba68525748ed66516ab5ae7c40bfc992fd3ebad39b3b8071b2a92297654fa5
SSDEEP 192:gRUf2TBdMEzbRv7+pYPRp5c6M9wHsb+WNnfoopGujn0kwWaQGi8yIsnAUgraJ:gRUfM1bB68XQOww9uA2ate
TLSH
T10452E82EB95065375DCAC72DFA15BB63DBF4203162941E84E6FC8E1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 75f4f98daf46c50f91e0864a790a8aeaac97e88888e034accb47f673cbb49505
MD5 60ad99321ba9fb1a248ccef68bd86663
SHA1 7387a48791fce96bff7aea7895fa789d93376ea2
SHA512 c374f19b6a68b7efead4d9d41c58a16e897f40557b7c627ddb23cc1d68334c3c58e2aa7e678df95d77d9389fffbbd95ba394e885976be6ec52706840148b6993
SSDEEP 192:gRUfATxdMEzbIv7+pYPRp5c6M9wHsb+WNnfoo+N02n0kwWaQGi8yIsnAUgraJ:gRUfKFbU68XQOwwz0H2ate
TLSH
T12F52F82EB91065376DCBD72DFA11BB63D7F5203162941E44E6FC8A1C18E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 86922480f2448ec55a992d7a244f3ec8b086e23709d1efd91e55b68365dba416
MD5 fc32ab6ba343de945dc093c0c4836023
SHA1 5a222199d0a319369ea3a397c6f055a5ad352129
SHA512 75fac706b3e44a699e509328633d21cbda2424c87269a4ea5542f48cd878a7586ead776aeb57af9282ce35455fbebe84ff5e52e0fc183f041bc57acac870a77b
SSDEEP 192:gRUfATxdMEzbev7+pYPRp5c6M9wHsb+WNnfoo+N02n0kwWaQGi8yIsnAUgraJ:gRUfKFba68XQOwwz0H2ate
TLSH
T11452F82EB91065376DCBD72DFA11BB63D7F5203562941E44E6FC8A1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 54fb8768d62f69b83b4434d5306d748d28ed01d56143a13a958164d0a3900ab3
MD5 895ba4891fa7da6e6a742715e4f88d2c
SHA1 eacf1fcb19bdf90b27bbbccfe3a51d6bd4576b53
SHA512 50c5e1fdb3bc2aeed645821229ffb28af53e9824ecd7c652964ed9146519b54a93dcf39ebb70d9302a104b36ac14022fed4b5503fbefdba2f5a39980d0c75711
SSDEEP 192:gRUr2TBdMEzbTv7+pAPRp2c6M9wHsb+WNnfoofgEfn0kwWaQAi8yIsnAUgraJ:gRUrM1br6UXrOww1Ec2aBe
TLSH
T1EE52092EB910253B9DCBD729FA21B763D7F5103561941E84E6FC8E1C19E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 939da5f64994c682bf34adf54f87e5652c2a2dbf616fe7e0dd19ae646992f9fd
MD5 ba792b81dfca1c4017085abe6de0cb56
SHA1 a87c1e7db3148873b18342bd863bb8202ef16775
SHA512 440ae82f1eb6a605b0649e882b9a8467fce68d2bd0a9294ba98e6beced62d3f5cff1c612405ab1779cf52cafc818517f4c88f6597c7313153f18a43b84c137af
TLSH
T138B0120580015211C0D206F0115638C871D99F249A0A170243E0A926C93557180181A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594e93.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594e93.TMP
Size 96B
SHA256 8e61711388e09e6672a21e967c4c758ded301d9b304b2f67ab991714c8fcd9e0
MD5 960fbcf8737d7ef2c0468130032e80fd
SHA1 d6d686248eccc6d6f39831db2988d80d56d9774e
SHA512 07c02847994a48b75245ea22bbc062dd355fdce9a04a0a7ff333ac6c6011505dbd81daee3cbf3cc6a3302e7392a9e858c872c608c06667f54e2a8d6f1da76812
TLSH
T145B0220EC0222203C00203F023AAC2C83020CF20CE03020383F02B23CE203B000283A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 276KB
SHA256 f365094fbc899f40e37866762fea5d7102e5008e2ec970565e84dc2015452fd4
MD5 125f33106105e7cdaa0003aa774fc538
SHA1 056d2adc983163257db6d8a421be87d26aa546c3
SHA512 e07ff1270e6627ef1f575f1ae4534c3b325f0f4faede625ca477e99d177fcb449ac110cec19996c8f0e52a933a0ee337a720f1e2f72fd4c2a2dc067d5bfaa0aa
SSDEEP 6144:RoJPa7/CyITxK+tkUVtZaGJb5ceWDfxA3OnjrYQ9EU0/hEg:uJS7/CDgKtZaGkDfxjjs+Cr
TLSH
T1DA5412B00D6A79E90F38EA1C201E7E606EE46EBD8A918DCB73543F0D54EFD90512B974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e945da04e8fc846c7c898e0fa485aa4c5052d35700ec41cbbf395d1c823c86a6
MD5 74dc5f6f35313b6d4b072acf0ffc223b
SHA1 da4c0aa0361fc16d706d5c934c966a0183f2346c
SHA512 4702ed18792e959a51923bb650814ed8f64d9b675d361e39d79fc7c68dbe13fd26e37551e43e6b23f0f851e83c0eac75b52f2f0e8e3c93aba799235e6b8ca3f4
SSDEEP 6144:61TxK+tkUVtZaGJb5ceWDfxA3OnjrYQ9EU0/hEg:EgKtZaGkDfxjjs+Cr
TLSH
T1153412B01C2679A90E79AB5C641E7D106EE47EED8A829DCBB2643F0D14EFDC04137978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d27d1653786e63de5aca75488529b97ba8773f1c6c073c72fa6f2afc4f7f4afc
MD5 5b9d989814a0b33f9b23e1107f07582c
SHA1 8c881758efc5dba94c4ed127b051694770bffac5
SHA512 f392fa05e5b589ee4fce7133741713ad488abecc91bb414ca8f2392cbe4c93b60223d9e26ce37af794d7d47996bda5f2fe1773054b6b780399bd4e3fa1ba0033
SSDEEP 3072:LzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:PWDfxA3OnjrYQ9EU0/hEg
TLSH
T15AC302A15C39BD660CB8EE95B44C3F60FFF4AD9A91879DC362E91B4C24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 49f965939285d3237843b087b4da067b0ba804f77bd980393f50b5d84bc6424f
MD5 ff04e5674486de2b46faf30d61c1d962
SHA1 47fa15f9ee6463e7fb6d4d3ddfcf3e011a4c562e
SHA512 de020a16e5a3ff27bf25222266a965e477aa3ef34dee36b9f3899d17d66b5b6a01fc330331a1da7b3f7923af4b5245749d8d6be49201d2a4c2019aef15d4b7f7
SSDEEP 6144:obTxK+tkUVtZaGJb5ceWDfxA3OnjrYQ9EU0/hEg:oXgKtZaGkDfxjjs+Cr
TLSH
T19F3412A00D6A79AD0E7CBB5C641E7D507EE46DEC4A829EC7A2643F1D04EBDC04036D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 992b3751933719e5d8c28d36a42e554e0af647b9c122be9f9dfaf2cd4fac3b7e
MD5 87a2fc8298e9cabd316ab7499b17abb2
SHA1 3682233b5602aa24ddff6ff7ee1148d97141b7b2
SHA512 c0b4dc89e83a743a3fe9abb2ddb67a340290d151bfc1ad5a9ce4ddab9bdcbf07e417f97243ff5e2d93692aea76436f7af01267432e8f8c8331b4eff9f740f2c2
SSDEEP 6144:9bTxK+tkUVtZaGJb5ceWDfxA3OnjrYQ9EU0/hEg:9XgKtZaGkDfxjjs+Cr
TLSH
T1233412A00D6A79AD0E7CBB5C641E7D507EE46DEC4A829EC7A2643F1D04EBDC04036D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 32bc08c5e4d3fb225bce68f45cff596f7463a64f45be77de5a512808e782d047
MD5 6d6ac658f00b84b8a1c1ca801bdd218f
SHA1 3bb362ccbd1fb324230f8f1586ff24b673bcb3b1
SHA512 fa2ca80eeff78323d194bcceffbe9e77abf161ecd42ba3fffea6f201b110216976daf918a641996d0b9f75566626bc15ba2d720ef183454efb612f83233fc68f
TLSH
T1BD216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B7A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d882e1873314838931f5fe2b4c96ddc80eed7c01666c451ff97f60b5a0d621f1
MD5 21b3c529a7e206eb12fa285441cda4ee
SHA1 f27ba49819f3d3a0c7c33cf5f33d5632d609eb76
SHA512 6003c091e4fa11a5b39b5f5ba3c93a114aab5c381dc69f8bab88d43ef496877f9e71f72fa25ea5f989d3e2f8fa2e9958ac56af6bbafce6dd6d82844aedde308e
TLSH
T176216833B3DCC025C8D9117A208CAD00B2B5C3C7449E8F9B7B84C519957F5DADB542A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dcbc1aef45112e151ba9824f9e96b52b6fcf148588197d7764de6dbfc773a25c
MD5 691a83dc0f12b352462b0f25d4c0622d
SHA1 a995c326f04d7ed972009983e4e386d28dcf7dff
SHA512 c19704b97f214378ad5ed0f1a8aa0d373627887f47667e0b149a115f48224bfb918d65fa8799bbc6502b4f84aac6feb548d3e9e93c32a085f175128aa31aa99f
TLSH
T114216533B3ECC125C8D9117A208CAD00B2B6C3C7449E8F8B7A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zagfreid.psw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zagfreid.psw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

iii6YXY0ma59.com

Path C:\Users\Admin\Downloads\iii6YXY0ma59.com
Size 11.2MB
SHA256 62cd3e4fac5039ae912ab886eab9921152a6a07801829add67053b56a40f794a
MD5 74a59a1bf55b071a9d8ea30825b0fb09
SHA1 205c7e8147278f5fe6067c594b1517a1cb2b1212
SHA512 6af52186c6772a6dc4dfe0f4f2fa8505d5fe733e21701e624b130b98936e54db22bb171f6a30a4f75a5067bdf1f015d5035e623960a26a67007a463a55397ae4
SSDEEP 196608:KoIL8bQeBk78Y6QN5ILCRVK3WHe5P+3horw4SdFx+MCiAFOKAyVrqNNgtsuULdol:KoIoGVTN5wCnoP+3h1CiVKAykNgtsuWG
TLSH
T19AC633EA6148331CC01EC5B0A433BD05B1F6531E4AD9D96BF6D7BAD077EE861DA02B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iii6YXY0ma59.com:Zone.Identifier

Path C:\Users\Admin\Downloads\iii6YXY0ma59.com:Zone.Identifier
Size 109B
SHA256 94612cd4a88676095b9d552bdd70e1a050ff7830f0438c501405e80e8683d93e
MD5 6f1bb4ed32bd3db4cc4185f3e4502e4b
SHA1 6f8bf3e1f7124f1c0ebe987e11f510052684682c
SHA512 869a6e8c9270bc5bf495041c4e3ab5071a21faabbaaa3e67e2e0419428a1d6b1cec353a2d9351ca3dd9b834be88cf17dbf0998a7c7d92a02ae34dc4ed9e86eab
TLSH
T169B0129B7A08C9250606EBC808AE9E2CF04F34D9CC5D870AD840809FEBD08E4C4E1427
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3808-224-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-106-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-135-0x000000014144F000-0x0000000141771000-memory.dmp

Download

memory/3808-199-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-46-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-8-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-6-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-222-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-229-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-228-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-227-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-226-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-230-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-221-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-132-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-223-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-52-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-225-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-54-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-51-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-58-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-57-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-56-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-307-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-308-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-309-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-310-0x000000014144F000-0x0000000141771000-memory.dmp

Download

memory/3808-55-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/3808-53-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/4028-0-0x000000014144F000-0x0000000141771000-memory.dmp

Download

memory/4028-1-0x00007FFCDEAD0000-0x00007FFCDEAD2000-memory.dmp

Download

memory/4028-2-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/4028-9-0x000000014144F000-0x0000000141771000-memory.dmp

Download

memory/4460-112-0x000001C94FB80000-0x000001C94FBA2000-memory.dmp

Download

memory/4460-120-0x000001C967F80000-0x000001C967F9C000-memory.dmp

Download

memory/4460-121-0x000001C967FA0000-0x000001C968053000-memory.dmp

Download

memory/4460-122-0x000001C968060000-0x000001C96806A000-memory.dmp

Download

memory/4460-123-0x000001C9682E0000-0x000001C9682FC000-memory.dmp

Download

memory/4980-348-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-387-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-453-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-366-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-378-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-385-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-384-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-380-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-381-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-383-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-382-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-379-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-386-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-369-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-363-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-368-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-358-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-411-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-364-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-365-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-362-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-450-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-367-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-452-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/5348-451-0x0000000140000000-0x00000001422A7000-memory.dmp

Download

memory/6040-409-0x000002A54ACC0000-0x000002A54AD73000-memory.dmp

Download