2995448ef6098df020183e079be1daca9eb809eae91859ae1b56f608d70d4611

Analysis

max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-2026-17085.vbs
Size 293KB
Sample260820-e14zsszbla
SHA256 2995448ef6098df020183e079be1daca9eb809eae91859ae1b56f608d70d4611
MD5 cdf279de18ea8ce3291e0a67f4ed5b2d
SHA1 07a4395273d255f83a5f01acf71e1ae71dbaae49
SHA512 8c5091917fe3b4e4151118e218fe0eb13f6b20df1a21017ba132dd08dec528d91059d3fb4fd7bc5c99e8adf04109ab8d7851fccc4c4368e168c766b452e003be
SSDEEP 3072:Q25C/YPNccJbVEWyHaBnBafRfv3SnbWfRrwYb9f7tqZXJorWZMlPwY9:Q2k/b2b/yHaBnBqAbML95frOY9
TLSH
T18D543F656DC17C84F07AD112DBCB8797E068FE91F7672A0665E383A403E0644BD83A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1320 created 3240	1320	powershell.exe	56

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1320	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1320	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4164	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
888	chrome.exe
4476	msedge.exe
1192	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1320	powershell.exe
1320	powershell.exe
1320	powershell.exe
2116	chrome.exe
2116	chrome.exe
740	svchost.exe
740	svchost.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
740	svchost.exe
740	svchost.exe
740	svchost.exe
740	svchost.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1320	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1320	powershell.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe
Token: SeBackupPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	740	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2116	chrome.exe
4156	msedge.exe
4156	msedge.exe
4992	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
740	svchost.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1320	4164	WScript.exe	86
PID 1320 wrote to memory of 740	1320	powershell.exe	88
PID 740 wrote to memory of 2116	740	svchost.exe	94
PID 2116 wrote to memory of 4596	2116	chrome.exe	95
PID 2116 wrote to memory of 2692	2116	chrome.exe	97
PID 2116 wrote to memory of 888	2116	chrome.exe	98
PID 2116 wrote to memory of 4524	2116	chrome.exe	99
PID 2116 wrote to memory of 1036	2116	chrome.exe	100
PID 2116 wrote to memory of 2752	2116	chrome.exe	101
PID 2116 wrote to memory of 1680	2116	chrome.exe	102
PID 2116 wrote to memory of 4296	2116	chrome.exe	103
PID 2116 wrote to memory of 4116	2116	chrome.exe	105
PID 740 wrote to memory of 2116	740	svchost.exe	94
PID 740 wrote to memory of 4156	740	svchost.exe	110
PID 740 wrote to memory of 4156	740	svchost.exe	110
PID 4156 wrote to memory of 3856	4156	msedge.exe	111
PID 4156 wrote to memory of 4856	4156	msedge.exe	113
PID 4156 wrote to memory of 4476	4156	msedge.exe	114
PID 4156 wrote to memory of 4856	4156	msedge.exe	113
PID 4156 wrote to memory of 4856	4156	msedge.exe	113
PID 4156 wrote to memory of 3228	4156	msedge.exe	115
PID 4156 wrote to memory of 3228	4156	msedge.exe	115
PID 4156 wrote to memory of 4268	4156	msedge.exe	125
PID 4156 wrote to memory of 4268	4156	msedge.exe	125
PID 4156 wrote to memory of 4268	4156	msedge.exe	125
PID 4156 wrote to memory of 4244	4156	msedge.exe	117
PID 4156 wrote to memory of 4244	4156	msedge.exe	117
PID 4156 wrote to memory of 4244	4156	msedge.exe	117
PID 4156 wrote to memory of 2556	4156	msedge.exe	118
PID 4156 wrote to memory of 2556	4156	msedge.exe	118
PID 4156 wrote to memory of 2556	4156	msedge.exe	118
PID 4156 wrote to memory of 1820	4156	msedge.exe	119
PID 4156 wrote to memory of 1820	4156	msedge.exe	119
PID 4156 wrote to memory of 1820	4156	msedge.exe	119
PID 4156 wrote to memory of 1168	4156	msedge.exe	122
PID 4156 wrote to memory of 1168	4156	msedge.exe	122
PID 4156 wrote to memory of 3776	4156	msedge.exe	124
PID 4156 wrote to memory of 3776	4156	msedge.exe	124
PID 740 wrote to memory of 4156	740	svchost.exe	110
PID 740 wrote to memory of 4992	740	svchost.exe	127
PID 4992 wrote to memory of 5028	4992	msedge.exe	128
PID 4992 wrote to memory of 4376	4992	msedge.exe	129
PID 4992 wrote to memory of 1192	4992	msedge.exe	130
PID 4992 wrote to memory of 4700	4992	msedge.exe	131
PID 4992 wrote to memory of 4132	4992	msedge.exe	132
PID 4992 wrote to memory of 3528	4992	msedge.exe	133
PID 4992 wrote to memory of 3088	4992	msedge.exe	134
PID 4992 wrote to memory of 116	4992	msedge.exe	135
PID 4992 wrote to memory of 2052	4992	msedge.exe	136
PID 4992 wrote to memory of 1796	4992	msedge.exe	137
PID 4992 wrote to memory of 4744	4992	msedge.exe	138
PID 4992 wrote to memory of 5124	4992	msedge.exe	139
PID 4992 wrote to memory of 5180	4992	msedge.exe	140
PID 4992 wrote to memory of 5188	4992	msedge.exe	141
PID 4992 wrote to memory of 5196	4992	msedge.exe	142
PID 4992 wrote to memory of 5204	4992	msedge.exe	143
PID 4992 wrote to memory of 2680	4992	msedge.exe	144
PID 4992 wrote to memory of 212	4992	msedge.exe	145
PID 740 wrote to memory of 4992	740	svchost.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO-2026-17085.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\9F9CAB49E\9F9CAB49E.ps1"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1320
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --headless=new --disable-gpu --no-first-run --noerrdialogs --no-sandbox --disable-extensions --window-position=-32000,-32000 --window-size=1,1 about:blank
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb7365c728,0x7ffb7365c734,0x7ffb7365c740
      4⤵
      PID:4596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --force-high-res-timeticks=disabled --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
      4⤵
      System Time Discovery
      PID:888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --force-high-res-timeticks=disabled --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
      4⤵
      PID:4524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      PID:1680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:2
      4⤵
      PID:4296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1908,i,17918790992214930685,1708809110623001501,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:2
      4⤵
      PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2d4,0x2e8,0x7ffb7313c188,0x7ffb7313c194,0x7ffb7313c1a0
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,8942090617955225579,12652785804519856007,262144 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,14832837691479421100,11410538735968516297,524288 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
      4⤵
      System Time Discovery
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,1640796349261914125,687139721710207482,524288 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,960868987427085935,11150341185147496712,2097152 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1400736705455192743,15804255578544421932,2097152 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7738951041635340850,10908607202686721472,2097152 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5828383852081039437,17111263217617178296,2097152 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11010822716757980529,12889708242748929530,524288 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12776217020769957274,14308699865739083571,524288 --field-trial-handle=2508,i,6131371126242421498,1542710057178526209,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --headless=new --disable-gpu --no-first-run --noerrdialogs --no-sandbox --disable-extensions --window-position=-32000,-32000 --window-size=1,1 about:blank
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x22c,0x230,0x234,0x228,0x280,0x7ffb7313c188,0x7ffb7313c194,0x7ffb7313c1a0
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      System Time Discovery
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:8
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:2
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:2
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:2
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:2
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2060,i,2589627695186914433,7141074866710822253,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
      4⤵
      PID:212

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7a73b197-9797-4ed9-b118-6b5a2d7f6d28.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7a73b197-9797-4ed9-b118-6b5a2d7f6d28.dmp
Size 77KB
SHA256 799653e8c8c942fb1e0915dddac5308f90ad4108f562186338e3f419d89a45ad
MD5 b0d30c1be1b212a4c1c8cc37de34ceeb
SHA1 76ae3ddb94f5541bcc7a27cfc5e48ae5cc8366a3
SHA512 9c92102f46ea16e079d8fed7cc55b804fe380003d55549dc752a5f88084e41fd3406834fabc09c7210493a398064d91c557d2b05c69bf60f2c12866af45b8e05
SSDEEP 192:dzh7+gGhWe5MLTQRi7EDj3htyh7FhU9ylKFh7SWSmPLUYPhVt0jlNvxGi+XTIug:dz2JO57W3hti7FRlKfX7Dqjlu1XEug
TLSH
T11273FEEAD78538B7C659973051DB2B12BBFAC4450BB3631EE31501BA6C777C868B4E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8fc0daac07f1cba5e2be811f2c7da605f08db262b2865fb00c09cca1533fed22
MD5 e7619e69fbf9c7d9fe17c1999fa8b04e
SHA1 575f392ad5a4f23b51afaaffbf2e0b1238e1f1b4
SHA512 1fda98c206a6952201f19fa3f6e5a870c6772631901131a611e7ac3372afd4e6c0c7455ffe8763964b5b3ecf7e6001df946800d571cba6fa8590a382591c5194
TLSH
T1EDD0A722291CF4C0E71802709212CF003B2A14A22553560AF315CC2D98B40C156D6BC2
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88634e8fcb2b5c9bc5e5a788e74d8f7fbfa2bd5d749b794da2224c239a1b7f23
MD5 a2d087b5c246fa6f4ac4b792fba96fab
SHA1 90e735438672b8f8f3d4949666a1f573379166a1
SHA512 313edf3dbf86a9dd69f68bc54264d81ec9e7f05b3776c5280ba348a708906024f4d64ff94c731de0b61dde3f2fcd5159af7b2edca9b2968c1023e5daa7762376
SSDEEP 192:qONx6O7+3hQmiUyyUygGttb0CO2b6h2SUgG7VZU6:qONx61jVgGt9DO5MSa7jU6
TLSH
T1D102E8346C686CB75EF2AE46BA8737275FA5103BE9952F84DAE81F0C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51701e827ac552f785b8062b113d5b9fbc3b33af41afb5a126dc1237e4298301
MD5 bb9844a6e8d97daa3b16a90ad2abc6c5
SHA1 74e39a17377abc82591a67ba02bed234c38373dc
SHA512 676f286c2fa2953c65be7d779b33ff5c9d24577828aedbf1076f07fea431c889c706125d4aef7f16d75d37832fa0f64dd8982db2f0cf5cc1e5f469ca13c22ff6
SSDEEP 192:0oTONIC6O7+35oMQmiUyymWyg0c2ttb0CO2b6h2zcF0SJr3ncN7QqtTU6:0aONIC6ffjsg0Xt9DO5MzYzJr3U7rU6
TLSH
T1D2120834A828AC7759E2B045F9C736639FA41077ED866F84D5D85E0C00DBB5C374AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e694c28583e485d9e96a1eacfec5f9d5da3eb9e8b501ec77889c139d9ef10a3
MD5 6174940700bd2a282b41d0e0074fd628
SHA1 e05a5a6ae62c7c6b02aa7ffe0996e0bebdffd9c0
SHA512 ad70747a07d255635c2d9887ad373a81be737af21f45567e4881c00b25712bb4b72dc7095526c25012b47fa7adf1e77cad82139f56ca9e46438d6818d52c91c3
TLSH
T19E41E858B6FA1158B3B7AF569BF6A86D487EBC372E4BD55E10010D4E0627E01C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 cec51be99c399d05a8d2b8d2c0587552a88500bc1fcd4a44c234047d27f71740
MD5 4062b9cede7a620333d3501dafcea8de
SHA1 bc2120959cda0ace28d15b31a877d9b3ef240b81
SHA512 386b836fbdff31f2b6191fa3a854e1e3d72268295a8ef95f91661c09c9a071eb387b98949b461ce9c59d47cbb01ab4e87f7bc84af0214b7f79928b4d503526fb
TLSH
T157515D5869FA1118B3B76F5A9BF674AE897E79632F07D49E10110E4E0A23B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

9F9CAB49E.ps1

Path C:\Users\Admin\AppData\Local\Temp\9F9CAB49E\9F9CAB49E.ps1
Size 1KB
SHA256 4e220eacf3bc91485771972f37e4d42c6453608f0c6a46718568b91e00a857b7
MD5 d86ee27c95f637ef9670446f3fb63dd4
SHA1 9855c0301262ea390fc260c15779a61561664e29
SHA512 d40f9e4c2a073c0e6ba95bda257446c190ca6015badbcc5d7798549d4d7bf4b8af0ba9848dde7c84d39f4db31314a5f539c223d61694cfc85c82c99fbaeadb57
TLSH
T185310460068AEE2806B541B3CD61478CA936EF1EB9CADE4177DFC62831472026BD635D
MD5 SHA1 SHA512 TLSH

Submit Download

9F9CAB49Ea

Path C:\Users\Admin\AppData\Local\Temp\9F9CAB49E\9F9CAB49Ea
Size 67KB
SHA256 caa39f7c9f349ae6c85975cfba907b8b2ae60bee5dd1bc0a452b7bff9c2c7d0a
MD5 a8dd80d9659ddba81cad0970df9a8fcb
SHA1 4787055f34d777e0c8d4346eda3ad1400834a396
SHA512 fe1d676f1404ae96e2780a0eabaccd92880bcbf5fdd3b5d4f6ba1d0124fba645a041ec6cb8a6368b2284d36ae92df096ac707d6375153190e53228b87991445f
SSDEEP 1536:BIQybTXEe4RmDU6tDCA1MuQJMtLPM4T6pngiC1c0:BQrcR6gxVetLPM4KgiKj
TLSH
T1596312365826BFB4693342ECAA5B53C0995118F2A45530AA9F22FECF5D1CFE34C8B14C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9F9CAB49Eb

Path C:\Users\Admin\AppData\Local\Temp\9F9CAB49E\9F9CAB49Eb
Size 67KB
SHA256 2b96c99a6880978e06a829b9e6a0092439c74a2366e8e5625fb8d334c47bf75b
MD5 17f01415138dcfb3a3ba7641e78a7fde
SHA1 ebe5e6a96e995cd282ebb36c0ee446756f705bd7
SHA512 dbc231875ea0309d78e8e677942ed85cc1ab81c85f06e01d8bc00818c43f5c7a6d95c094063fcc2da882731e5e542c406b340659aa3a10d638aa64ff298fdcb6
SSDEEP 1536:hMF+4fl8iDreMKzjwjQgwHe+f3cuWDzZ0O6Uq:eZmAyjGNK3cuWH1tq
TLSH
T16F631334AC6465A0FF9ADE3CFD22B8B521266B834745DDDC868375DFB5A188093F8C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pj0edsnc.0jc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pj0edsnc.0jc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240676937\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Crashpad\settings.dat
Size 280B
SHA256 f57c28a6615b3f61142a71c50585e77e5810ee6a72c0069dbabdf1c2f7514c85
MD5 0cadf897f1d09b7036eb6bd0c37e4642
SHA1 b89303f1af9f2debec87f2d246d68a2eb221a945
SHA512 ed84e108995a08c32013bb58084eac69ab7f15bf5c4cbd7d30c0535ba70635a660ae6db4a7fcc95a108442acf101402aaba0770a36aabf0798d2456a0085ded1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Crashpad\settings.dat
Size 280B
SHA256 aceb421f3237a2812234dff9d2516b8883240e4653b901ba5950bd560cc8d19d
MD5 a6e55a27d8a9995df7d0b8290a0efb4a
SHA1 a8fc4589a806f3d49f240fd32671f28f5ff027c5
SHA512 cbdd33093a3c4bff3addb612a310080a95239b7a014dbfc92ccbc924d4dd76edf2fab8c0bf7bb253f0dcbd1f6dcb11d249e4525151dcecd66ec6788dffdc23ee
TLSH
T178D02477F700104DC05D113D04D1F35030F4CC3100471D101110D1040C41131140F144
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Local State
Size 3KB
SHA256 057dcab9ec0c134fee4e0616d2cc8a5debbf810dd0435d07f3738d9eadfb649f
MD5 951f9698f7b6308348aa98fbce84fcde
SHA1 f8c59d16445d84a70016c724e57ca8da8d7d76c6
SHA512 6e4184ce467fc9e8981698f964ff4801395069df954f1a0391748361cf04eed28bf6c58caaf1e789ec6fc89e244edecf7548f4583a0458225b484204b6d4268a
TLSH
T15C81B6716828FC3355E56948B58A36A29F787473E845AF55E6D8130800E73AC3B4DC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Local State
Size 4KB
SHA256 b76274aa85112196d9ef4e458c8392ae01428eef95e361b3257d969c926d7688
MD5 af8789f1710036d1bba666d7754ae5ba
SHA1 10742cde545c39ff586859633713b6f0741ddf7f
SHA512 10772ad7d6190f84b64a9985f717399cbf89ad085ef47f48bddb69d277e2ee0a0159798e6395f2b6e799ab07b45cfaac6560a789463337af2971f267de83fa86
SSDEEP 96:0zqGNk3BeQsFftaIq2mTJ58Frh/cInURoDotovyidADyTdB0jovDTIl7WM0eUcHh:0WGNIrUaIqVsooDUwyVyTD0SIl7D1Hh
TLSH
T1B9A1B7716878FC3759E5AD44B4CA3762AFB46133E885BF99EAD8160C00E73D8274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588ad6.TMP

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240683312\Local State~RFe588ad6.TMP
Size 1KB
SHA256 050aef27a9e5212d410773a52820dab34827799c57a71f13194ed6e47aa3c649
MD5 850d7e58cc9b8515d098348cc4fd4353
SHA1 5b0d72c76003570a7b61bc58ba0994191893f665
SHA512 280d8b31cc6994c488b4032f9155aee2ed10805658338237468b857afc85ac9ef0d6a58e5c7a43ef5b064ffe0543782efe2a24965216d7f7380ff04cff77f83a
TLSH
T1C23195B1BCA8B877F4A15A45A38E7A331F7465319045BE8455DD160C01E36EC771EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/740-21-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-35-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-37-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-36-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-28-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-27-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-29-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-31-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-32-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-33-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-34-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-38-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-30-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-19-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-20-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-22-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/740-23-0x0000000140000000-0x000000014052B000-memory.dmp

Download

memory/1320-5-0x0000020480080000-0x0000020480090000-memory.dmp

Download

memory/1320-18-0x00000204997D0000-0x00000204997E2000-memory.dmp

Download

memory/1320-17-0x0000020499780000-0x00000204997D2000-memory.dmp

Download

memory/1320-13-0x00000204FFAB0000-0x00000204FFAD2000-memory.dmp

Download

memory/1320-4-0x0000020480080000-0x0000020480090000-memory.dmp

Download