Overview

overview

8

Static

static

3

EA DLC Unl...-0.zip

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    349s
  • max time network
    352s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/09/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EA DLC Unlocker v2 160-0.zip
  • Size 1.2MB
  • Sample260903-sfbdmswtct
  • SHA256 83880888daf08818137ae4129da2166feecf237c27aea9064dc0a80e4bc6e5a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 52 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2 160-0.zip"
    1⤵
      PID:5552
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:6672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\EA DLC Unlocker v2\setup.bat" "
        1⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:7064
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo marco "
          2⤵
            PID:6356
          • C:\Windows\System32\findstr.exe
            findstr /C:"polo"
            2⤵
              PID:7036
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo marco "
              2⤵
                PID:5964
              • C:\Windows\System32\findstr.exe
                findstr /V /C:"polo"
                2⤵
                  PID:3464
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\Desktop\EA DLC Unlocker v2\" "
                  2⤵
                    PID:2592
                  • C:\Windows\System32\findstr.exe
                    findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
                    2⤵
                      PID:2920
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -noprofile "$_PSCommandPath = [Environment]::GetEnvironmentVariable('script_path', 'Process'); iex ((Get-Content -LiteralPath $_PSCommandPath) | out-string)"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5040
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    1⤵
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:1296
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8e8c9c728,0x7ff8e8c9c734,0x7ff8e8c9c740
                      2⤵
                        PID:5668
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,1736746811061747230,13111966765142111975,262144 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
                        2⤵
                          PID:928
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,16843665837235843246,3338615421767922832,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
                          2⤵
                          • Downloads MZ/PE file
                          • System Time Discovery
                          PID:524
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,454972794440074523,4583837496159961176,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
                          2⤵
                            PID:5956
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,8438817066675919176,1952221646465972971,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                            2⤵
                              PID:3716
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,15686545664208621312,11716150794496535302,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                              2⤵
                                PID:3652
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,9482931776660532154,6381931575155888645,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
                                2⤵
                                  PID:1228
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,2613019990745691982,6833228376621599372,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                                  2⤵
                                    PID:4884
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5000,i,16858757782488231965,16735364455651316830,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
                                    2⤵
                                      PID:5632
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,4405752272062901315,5327529227481633595,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
                                      2⤵
                                        PID:3704
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,6715373023837324050,17187363216489380655,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                                        2⤵
                                          PID:2200
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,16568240338067795038,16806125357659680479,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
                                          2⤵
                                            PID:6468
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5728,i,5480346140376526703,3680530883951272264,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
                                            2⤵
                                              PID:4892
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5876,i,3819476068497524634,299734230205924631,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
                                              2⤵
                                                PID:4652
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6184,i,5901669771760870407,7108728263869478080,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
                                                2⤵
                                                  PID:2924
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6196,i,6876409462126365036,4428845156905319202,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
                                                  2⤵
                                                    PID:3632
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6268,i,6380466718933513665,1383534826115775538,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
                                                    2⤵
                                                      PID:2940
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6340,i,10445556758558017219,16476693973363855710,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
                                                      2⤵
                                                        PID:3540
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5976,i,2826799091387517648,16412284104255990623,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
                                                        2⤵
                                                          PID:940
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3672,i,3426865204055125785,10451595970832365308,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
                                                          2⤵
                                                            PID:4428
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5576,i,4573868576638616053,11114321354872580797,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
                                                            2⤵
                                                              PID:1540
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,4801939498251765452,623612182332040380,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                                                              2⤵
                                                                PID:4588
                                                              • C:\Users\Admin\Downloads\EAappInstaller.exe
                                                                "C:\Users\Admin\Downloads\EAappInstaller.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5152
                                                                • C:\Windows\Temp\{2219380C-449B-4BCB-8F21-960DE7EE9648}\.cr\EAappInstaller.exe
                                                                  "C:\Windows\Temp\{2219380C-449B-4BCB-8F21-960DE7EE9648}\.cr\EAappInstaller.exe" -burn.clean.room="C:\Users\Admin\Downloads\EAappInstaller.exe" -burn.filehandle.attached=692 -burn.filehandle.self=700
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks whether UAC is enabled
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:620
                                                                  • C:\Windows\Temp\{324DD80C-73E3-431B-8DBD-EFE11854ED32}\.be\EAappInstaller.exe
                                                                    "C:\Windows\Temp\{324DD80C-73E3-431B-8DBD-EFE11854ED32}\.be\EAappInstaller.exe" -q -burn.elevated BurnPipe.{2A8FD9D6-5FF0-4731-988E-B83751A3F26A} {55FC5990-20F5-4EA5-B742-0A6F0341C9E4} 620
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    PID:4656
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,3645284542813964940,15256295517104628662,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
                                                                2⤵
                                                                  PID:5220
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,7250310207002766826,17785544903965503683,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
                                                                  2⤵
                                                                    PID:6424
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,17930099446136094173,7618095349672899584,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                                    2⤵
                                                                      PID:4356
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6776,i,5262740376484582246,5068370208738098649,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
                                                                      2⤵
                                                                        PID:1204
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6740,i,1159378535963906607,17278976556137660442,2097152 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:9
                                                                        2⤵
                                                                          PID:5948
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,8527851134191790324,1416436280346593096,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
                                                                          2⤵
                                                                            PID:3928
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,5375216611224880707,7109229461318132826,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
                                                                            2⤵
                                                                              PID:6992
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,13586825262365157646,10181015808405657793,524288 --field-trial-handle=1892,i,16559661777369487388,18130374042765880103,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                              2⤵
                                                                                PID:4752
                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                              1⤵
                                                                                PID:3832
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                1⤵
                                                                                  PID:6072
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                  1⤵
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:4432
                                                                                • C:\Windows\system32\vssvc.exe
                                                                                  C:\Windows\system32\vssvc.exe
                                                                                  1⤵
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5396
                                                                                • C:\Windows\system32\srtasks.exe
                                                                                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                  1⤵
                                                                                    PID:4700
                                                                                  • C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe
                                                                                    "C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe" /burn.runonce
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:6796
                                                                                    • C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe
                                                                                      "C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\EA_app_20260903160516.log"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2468
                                                                                      • C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe
                                                                                        "C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe" -burn.clean.room="C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\EAappInstaller.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\EA_app_20260903160516.log"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Checks whether UAC is enabled
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5428
                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                    1⤵
                                                                                    • Enumerates connected drives
                                                                                    • Drops file in Program Files directory
                                                                                    • Drops file in Windows directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2784
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 22315F4DE820F5F5CF9F559F3550E92B
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4628
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSI9104.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240881937 12 juno-custom-actions!JunoCustomActions.JunoCustomActions.InitializeSession
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2876
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSID50B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240899343 80 juno-custom-actions!JunoCustomActions.JunoCustomActions.LaunchClient
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3940
                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe
                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3176
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 9721386E8B65910C535E56EAA0A82FEA E Global\MSI0000
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5820
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIA633.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240887453 18 juno-custom-actions!JunoCustomActions.JunoCustomActions.CloseOrigin
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5724
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIA77C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240887750 22 juno-custom-actions!JunoCustomActions.JunoCustomActions.BackupCloudSaves
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1324
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIA904.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240888093 26 juno-custom-actions!JunoCustomActions.JunoCustomActions.UninstallOrigin
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3276
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIAA1E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240888375 30 juno-custom-actions!JunoCustomActions.JunoCustomActions.CreateAdminWritableDirectories
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2692
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIAB96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240888750 39 juno-custom-actions!JunoCustomActions.JunoCustomActions.ConfigureRegistry
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:6000
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSIC970.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240896390 55 juno-custom-actions!JunoCustomActions.JunoCustomActions.SetupSymlinkMode
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:7016
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Windows\Installer\MSID306.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240898828 69 juno-custom-actions!JunoCustomActions.JunoCustomActions.ConfigureShortcuts
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5948
                                                                                  • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe
                                                                                    "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe" -start
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3636
                                                                                    • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe
                                                                                      "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe" -register
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      PID:6744
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                    1⤵
                                                                                      PID:5900
                                                                                    • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe
                                                                                      "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe" -ls=Launcher
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3652
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=gpu-process --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=2700 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2752
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3004 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2776
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3020 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:976
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe" -ipcport=52170
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1440
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --first-renderer-process --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4880 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5940
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5992
                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe
                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5116 --field-trial-handle=2860,i,4550539555970427239,11949853355486825713,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4240
                                                                                    • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe
                                                                                      "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe" -silentOs
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:6416
                                                                                    • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe
                                                                                      "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe" -silentOs -ls=Launcher
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5940
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\EA DLC Unlocker v2\setup.bat" "
                                                                                      1⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:4944
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                        2⤵
                                                                                          PID:1100
                                                                                        • C:\Windows\System32\findstr.exe
                                                                                          findstr /C:"polo"
                                                                                          2⤵
                                                                                            PID:4400
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                            2⤵
                                                                                              PID:1048
                                                                                            • C:\Windows\System32\findstr.exe
                                                                                              findstr /V /C:"polo"
                                                                                              2⤵
                                                                                                PID:1288
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\Desktop\EA DLC Unlocker v2\" "
                                                                                                2⤵
                                                                                                  PID:6452
                                                                                                • C:\Windows\System32\findstr.exe
                                                                                                  findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
                                                                                                  2⤵
                                                                                                    PID:4580
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -noprofile "$_PSCommandPath = [Environment]::GetEnvironmentVariable('script_path', 'Process'); iex ((Get-Content -LiteralPath $_PSCommandPath) | out-string)"
                                                                                                    2⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:6428
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\EA DLC Unlocker v2\setup.bat" "
                                                                                                  1⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:6556
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                                    2⤵
                                                                                                      PID:3972
                                                                                                    • C:\Windows\System32\findstr.exe
                                                                                                      findstr /C:"polo"
                                                                                                      2⤵
                                                                                                        PID:3964
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                                        2⤵
                                                                                                          PID:240
                                                                                                        • C:\Windows\System32\findstr.exe
                                                                                                          findstr /V /C:"polo"
                                                                                                          2⤵
                                                                                                            PID:4304
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\Desktop\EA DLC Unlocker v2\" "
                                                                                                            2⤵
                                                                                                              PID:5504
                                                                                                            • C:\Windows\System32\findstr.exe
                                                                                                              findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
                                                                                                              2⤵
                                                                                                                PID:6252
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -noprofile "$_PSCommandPath = [Environment]::GetEnvironmentVariable('script_path', 'Process'); iex ((Get-Content -LiteralPath $_PSCommandPath) | out-string)"
                                                                                                                2⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5244
                                                                                                            • C:\Windows\System32\NOTEPAD.EXE
                                                                                                              "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EA DLC Unlocker v2\setup.bat
                                                                                                              1⤵
                                                                                                                PID:6312
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\EA DLC Unlocker v2\setup.bat" "
                                                                                                                1⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:5116
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                                                  2⤵
                                                                                                                    PID:4244
                                                                                                                  • C:\Windows\System32\findstr.exe
                                                                                                                    findstr /C:"polo"
                                                                                                                    2⤵
                                                                                                                      PID:6824
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo marco "
                                                                                                                      2⤵
                                                                                                                        PID:1232
                                                                                                                      • C:\Windows\System32\findstr.exe
                                                                                                                        findstr /V /C:"polo"
                                                                                                                        2⤵
                                                                                                                          PID:1524
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\Desktop\EA DLC Unlocker v2\" "
                                                                                                                          2⤵
                                                                                                                            PID:3992
                                                                                                                          • C:\Windows\System32\findstr.exe
                                                                                                                            findstr /V /C:"C:\Users\Admin\AppData\Local\Temp"
                                                                                                                            2⤵
                                                                                                                              PID:4560
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -noprofile "$_PSCommandPath = [Environment]::GetEnvironmentVariable('script_path', 'Process'); iex ((Get-Content -LiteralPath $_PSCommandPath) | out-string)"
                                                                                                                              2⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:3952
                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                "C:\Windows\System32\schtasks.exe" /Query /TN copy_dlc_unlocker
                                                                                                                                3⤵
                                                                                                                                  PID:5356
                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                  "C:\Windows\System32\schtasks.exe" /Create /F /RL HIGHEST /SC ONCE /ST 00:00 /SD 01/01/2000 /TN copy_dlc_unlocker /TR "xcopy.exe /Y 'C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\version.dll' 'C:\Program Files\Electronic Arts\EA Desktop\StagedEADesktop\EA Desktop\*'"
                                                                                                                                  3⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3632
                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                  "C:\Windows\System32\schtasks.exe" /Query /TN copy_dlc_unlocker
                                                                                                                                  3⤵
                                                                                                                                    PID:2532
                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                    "C:\Windows\System32\schtasks.exe" /Delete /TN copy_dlc_unlocker /F
                                                                                                                                    3⤵
                                                                                                                                      PID:5228
                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                      "C:\Windows\System32\schtasks.exe" /Query /TN copy_dlc_unlocker
                                                                                                                                      3⤵
                                                                                                                                        PID:1388
                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                        "C:\Windows\System32\schtasks.exe" /Create /F /RL HIGHEST /SC ONCE /ST 00:00 /SD 01/01/2000 /TN copy_dlc_unlocker /TR "xcopy.exe /Y 'C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\version.dll' 'C:\Program Files\Electronic Arts\EA Desktop\StagedEADesktop\EA Desktop\*'"
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4524
                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                        "C:\Windows\System32\schtasks.exe" /Query /TN copy_dlc_unlocker
                                                                                                                                        3⤵
                                                                                                                                          PID:4972
                                                                                                                                    • C:\Windows\system32\xcopy.exe
                                                                                                                                      xcopy.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:872
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALauncher.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALauncher.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1220
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALaunchHelper.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALaunchHelper.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:2352
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EADesktop.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EADesktop.exe" -updater_call -ls=LaunchHelper -gameSdkPort=3216
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4996
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=gpu-process --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=2792 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5328
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3104 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:6988
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3124 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3992
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALocalHostSvc.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALocalHostSvc.exe" -ipcport=53602
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2780
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --first-renderer-process --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4612 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5460
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4832 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4020
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4916 --field-trial-handle=2968,i,5342471673727230674,237482706426251,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3864
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe" -start
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:592
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALauncher.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALauncher.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1512
                                                                                                                                      • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EADesktop.exe
                                                                                                                                        "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EADesktop.exe" -ls=Launcher
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:5220
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=gpu-process --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=2836 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4136
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3004 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:756
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=3056 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:6276
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALocalHostSvc.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EALocalHostSvc.exe" -ipcport=54229
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:1900
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --first-renderer-process --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4636 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4748
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4860 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5584
                                                                                                                                        • C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe
                                                                                                                                          "C:\Program Files\Electronic Arts\EA Desktop\13.783.0.6296\EA Desktop\EACefSubProcess.exe" --type=renderer --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.783.0.6296 Chrome/109.0.5414.120" --user-data-dir="C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop" --enable-smooth-scrolling --no-sandbox --log-file="C:\ProgramData\EA Desktop\Logs\cef.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5232 --field-trial-handle=3220,i,9663701895529730697,2690883887796364862,131072 --enable-features=EstablishGpuChannelAsync --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2696

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                            2
                                                                                                                                            T1059

                                                                                                                                            PowerShell

                                                                                                                                            1
                                                                                                                                            T1059.001

                                                                                                                                            Windows Command Shell

                                                                                                                                            1
                                                                                                                                            T1059.003

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Persistence

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            1
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Component Object Model Hijacking

                                                                                                                                            1
                                                                                                                                            T1546.015

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            1
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Component Object Model Hijacking

                                                                                                                                            1
                                                                                                                                            T1546.015

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Modify Registry

                                                                                                                                            1
                                                                                                                                            T1112

                                                                                                                                            Credential Access

                                                                                                                                            Discovery

                                                                                                                                            Browser Information Discovery

                                                                                                                                            1
                                                                                                                                            T1217

                                                                                                                                            Peripheral Device Discovery

                                                                                                                                            2
                                                                                                                                            T1120

                                                                                                                                            Query Registry

                                                                                                                                            5
                                                                                                                                            T1012

                                                                                                                                            System Information Discovery

                                                                                                                                            5
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            System Time Discovery

                                                                                                                                            1
                                                                                                                                            T1124

                                                                                                                                            Lateral Movement

                                                                                                                                            Collection

                                                                                                                                            Command and Control

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            e5b70bb.rbs
                                                                                                                                            • Path C:\Config.Msi\e5b70bb.rbs
                                                                                                                                            • Size 1.2MB
                                                                                                                                            • SHA256 7b060b92880ea0a175847728e428a46edd382445d94cc2c1fda3a39c70d98d03
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            IQ
                                                                                                                                            • Path C:\ProgramData\EA Desktop\530c11479fe252fc5aabc24935b9776d4900eb3ba58fdc271e0d6229413ad40e\IQ
                                                                                                                                            • Size 128B
                                                                                                                                            • SHA256 f57e2d0f98125c173d0d5a4df3aaacdf7a1e26833c0c8dc6ee1d47a4f76137d6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            state.rsm
                                                                                                                                            • Path C:\ProgramData\Package Cache\{21ca9f54-40d3-4f5e-9562-6fb0c1dffdf9}\state.rsm
                                                                                                                                            • Size 834B
                                                                                                                                            • SHA256 796bfd781138a78f69a99329a5a3c447df17f9be01125b7322da81241f57e7e7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\D3DSCache\dc87c23cc0d7db70\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                            • Size 64KB
                                                                                                                                            • SHA256 95f16e2a3a29392ef11e7648596f33002f92b2e7f3526e2928eddcb940fd894e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\D3DSCache\dc87c23cc0d7db70\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                            • Size 4B
                                                                                                                                            • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\D3DSCache\dc87c23cc0d7db70\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 888382da851e8e21eaf0471fc2d34fba0db79c4276d53daa8e773bebacb614de
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\D3DSCache\ea0d72fd3c607a25\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                            • Size 64KB
                                                                                                                                            • SHA256 49075af246902d6707670e293c56839d305bb8387693d5b68c60887e69102b72
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\D3DSCache\ea0d72fd3c607a25\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 a6071a660f2d8e3f2cd19111203e5c10b6cad3ccf06795480829cd388663cdfa
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            32a044c6e3fa64e8f47347d1cfda4366bad8d8d8.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\32a044c6e3fa64e8f47347d1cfda4366bad8d8d8.qmlc
                                                                                                                                            • Size 18KB
                                                                                                                                            • SHA256 c8fcf494c18eea28b378d453f661cbb260f469588d6e61dff235479a28bfa963
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            4485f6482f1800088e6896e506244ea8a999a028.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\4485f6482f1800088e6896e506244ea8a999a028.qmlc
                                                                                                                                            • Size 7KB
                                                                                                                                            • SHA256 fbdd194ef3ca6b8fdf0a3e83da97ca09560018e5547c7b827db48a078b4ab292
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            5812facb6e80ab2687de648df36e26ae8fa97422.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\5812facb6e80ab2687de648df36e26ae8fa97422.qmlc
                                                                                                                                            • Size 14KB
                                                                                                                                            • SHA256 910784fd15845427a662ed9445082b415e814363eaf77ba9db2b4d74fa503927
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            7117211bfe982a5e601b432516d235e731b49265.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\7117211bfe982a5e601b432516d235e731b49265.qmlc
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 cbcd64205ed74e7d0ec01f1bd76392e26b2fd5d6ac8287e1e70884810353d125
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            7370793e81061b38b8e88ad6193fc3faf00f6b8c.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\7370793e81061b38b8e88ad6193fc3faf00f6b8c.qmlc
                                                                                                                                            • Size 5KB
                                                                                                                                            • SHA256 ae4cdb9a59cc37c4ba39f53b6e9c59532e9719a9ffa30eaad43d8bc1a6fd151c
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            76aca5c7844b29e0362f70becc73c1f0b6cc503b.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\76aca5c7844b29e0362f70becc73c1f0b6cc503b.qmlc
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 ff5728e973180eaa37efb24e765839d4a5757a085f19260c2b19bf18fa64f874
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            7f5300ef4b91d96d59b0af09f2aaf239c87c36aa.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\7f5300ef4b91d96d59b0af09f2aaf239c87c36aa.qmlc
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 72520787d178ab1a35dc64edac2d01feb606e290a44e15f7d47f287ea723e47b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            964daa43fc181d9523a667992992d778d309b1ae.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\964daa43fc181d9523a667992992d778d309b1ae.qmlc
                                                                                                                                            • Size 5KB
                                                                                                                                            • SHA256 e5ac468ff5b996ed3bf44dc4be65669ca22575964b58ebb0d62e752ea835092b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            abd3ed7a0906fcad52405103d248d9e119484886.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\abd3ed7a0906fcad52405103d248d9e119484886.qmlc
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 f16ee769740a81d026297836827752a2edb6f279c92e32587b62c86be54764f8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            be8081c2a46e6ea234ef4c014e37d18b0a1fab5a.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\be8081c2a46e6ea234ef4c014e37d18b0a1fab5a.qmlc
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 b65865334667525fb661e3af88bce680fe4f94bbef7634552a660fb871e64953
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            cd2647f61919d705374eaea7828aedde5e9f148a.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\cd2647f61919d705374eaea7828aedde5e9f148a.qmlc
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 66bb080be74fb8aaf6304b09a43aebf5bcd4bd8ec89b1f075b6fb21ee9702f33
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            d09a7f44ad5c474419a6e6c0166d853b20cd9d8b.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\d09a7f44ad5c474419a6e6c0166d853b20cd9d8b.qmlc
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 8ee1107d8b2beb1d68e91581cd761200311a8b3140a9336e6eacd6a37f573b08
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            e41ff2ed6e4f7206dc3105ca0cfb5fddf643ada4.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\e41ff2ed6e4f7206dc3105ca0cfb5fddf643ada4.qmlc
                                                                                                                                            • Size 26KB
                                                                                                                                            • SHA256 56edf545dfe444ccfbc7005fc03a4b59ded0e7cf365ae1c7dcb1e134529554bb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            f80ae2511dd8f9a41e7b5e1740d7fc23d571371c.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EADesktop\cache\qmlcache\f80ae2511dd8f9a41e7b5e1740d7fc23d571371c.qmlc
                                                                                                                                            • Size 11KB
                                                                                                                                            • SHA256 a1b550ea97ddca79c9ae29b8d54435a352d07fc15504233f8b42c98ce7acf374
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            1b3d4ef8dc51c211d071dd9643ca4d9d7ebd2c15.jsc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\1b3d4ef8dc51c211d071dd9643ca4d9d7ebd2c15.jsc
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 c44e65675b7a0287d3aa97c14d9e7f292624fb2eeed2de30a5065fbae4158524
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            261125e092ce6c5bcbacaacd19f4baaa145b2306.jsc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\261125e092ce6c5bcbacaacd19f4baaa145b2306.jsc
                                                                                                                                            • Size 12KB
                                                                                                                                            • SHA256 88477cc50684a27b27b70b03331b3373a83a976b4583d98935a423d5eca591fb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            27697eb81c52bbec53392ae8c38fe098840a0dbc.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\27697eb81c52bbec53392ae8c38fe098840a0dbc.qmlc
                                                                                                                                            • Size 10KB
                                                                                                                                            • SHA256 e5e0b4ae581b9c788bd0e84c324ff3cd61a0528524322eabb25fcabe00fcf6b3
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            2925e079b7444b788e831a918f4d86684de84e5e.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\2925e079b7444b788e831a918f4d86684de84e5e.qmlc
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 976db5860f548940ff5733e98206ee5d6894c3b795f8c5775d73ea2c012e2c9a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            6abf8bc822a78dab925b5aecd408c8f712144ed7.jsc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\6abf8bc822a78dab925b5aecd408c8f712144ed7.jsc
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 7e1dcc1ea1ca066d9f9a67cbbf49d4b75195888a93f2d90505dd0fdc0d031f6d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            9e0776591d397d669c797d38891d79800e85f198.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\9e0776591d397d669c797d38891d79800e85f198.qmlc
                                                                                                                                            • Size 34KB
                                                                                                                                            • SHA256 5cb9357a862f66dff09258e530ec154bbbd43590e48a3b4dbf373eb3bedbc60f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            a86e37c8d30e99cf9bca5e3c07a5945a9160d27f.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\a86e37c8d30e99cf9bca5e3c07a5945a9160d27f.qmlc
                                                                                                                                            • Size 21KB
                                                                                                                                            • SHA256 51931e57119af483e4aedf28f102931ed9595526241cb7172b4a49b2c6c1342a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            bcc2add735b60af020d11ac556d67510ed3c6777.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\bcc2add735b60af020d11ac556d67510ed3c6777.qmlc
                                                                                                                                            • Size 15KB
                                                                                                                                            • SHA256 fe789f6986f42d216306e5dd3844801f0566770816b6724df6cf5a4a4f3fe46f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            c5112216222130658e80de1032e3ed846442822a.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\c5112216222130658e80de1032e3ed846442822a.qmlc
                                                                                                                                            • Size 892B
                                                                                                                                            • SHA256 57f2cbe722da0bb9f6db43f90202ace6c359fc64ac75322615eef36d03a5f6d8
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            c8fd5d2cd6326cf040726d131acd1b5b57dc2693.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\c8fd5d2cd6326cf040726d131acd1b5b57dc2693.qmlc
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 7fdc25bdaff57729605db17969b72297156b19b5a4d916fe15ad81f0f9fe9f62
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            cca43c5d62ca765a2ad11b2d8fe55b551767ded8.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\cca43c5d62ca765a2ad11b2d8fe55b551767ded8.qmlc
                                                                                                                                            • Size 9KB
                                                                                                                                            • SHA256 d3318aca49bdbcd868c1a8d21af038fa7dfefbedee6faefa315412fcadd7d57e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            ddac86e99efc18370e9ff22c10507df3d6a8a593.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\ddac86e99efc18370e9ff22c10507df3d6a8a593.qmlc
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 51e9c90090c42fe609c5804c2af45fcdfecbfe502ac4fcf135da9c5c21afccb3
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            e6507e0475c93f41db84357b15119f32753d371e.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\e6507e0475c93f41db84357b15119f32753d371e.qmlc
                                                                                                                                            • Size 9KB
                                                                                                                                            • SHA256 b070faff10d589689ecb244ff803cff6b9005d912a2b6fb50b9076a569447739
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            ed5e38c15f3beadb79c8a4faa9524d5c5e575f86.qmlc
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\EALaunchHelper\cache\qmlcache\ed5e38c15f3beadb79c8a4faa9524d5c5e575f86.qmlc
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 53f65720f76ae605b71607d6a3497f9b27338277a6f4d021d661569540050307
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Code Cache\js\index
                                                                                                                                            • Size 24B
                                                                                                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 48B
                                                                                                                                            • SHA256 689de22787bf0d0110cb5c49bd24fdce4f17c1fafdad0f9342f388756e6fc2e4
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 360B
                                                                                                                                            • SHA256 4dec04828f68ba3bfe89c6b79d53d786eeb52cd829b054c76b737c151da42f64
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 480B
                                                                                                                                            • SHA256 90ec2dad648df225fb07ef4fb5a8dbf3f8969a0a77173084686be7d5b8206da0
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Network\Network Persistent State
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 35e4adb9848f06f7c0533c9d2842e608e85093051a12a7effa08837511ade764
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Network\Network Persistent State
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f4f406cc616f3a41815348fdc9d77ceb7a6621affe31d71d7ed3dd6374ab1f16
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            TransportSecurity
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Electronic Arts\EA Desktop\CEF\2\EADesktop\BrowserCache\Network\TransportSecurity
                                                                                                                                            • Size 704B
                                                                                                                                            • SHA256 96ea2589df87c83d088c904c8f3f6771036beb14c4e4ea8ed4aec0cf7a6e3b8c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                            • Size 6B
                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 6fe693e3e75938c5e1a0c1675b9bfb5c2dc5ff7fccec9bb26aeb336b411aaeff
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            messages.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                                            • Size 593B
                                                                                                                                            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            craw_background.js
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                                            • Size 531KB
                                                                                                                                            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            CURRENT
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                                                                            • Size 16B
                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 c3cdb8c1a2e689354b2feb1d0ee5019c1a014c9c831440c8b20408196906e137
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                            • Size 2B
                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            TransportSecurity
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 ded42c6084e8d3f72cd8e4126af4b6befcdb25c6301f60f41e0010d150acb13c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                            • Size 12KB
                                                                                                                                            • SHA256 8d00a25216deac22bffdf7e58e31471a5e03b8f415f1abb0a19495ff88c9ed68
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                            • Size 13KB
                                                                                                                                            • SHA256 6480b3c0e192d9895624e8bfb6639330f642635b23f5f1efa50304c7b7a9643a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                            • Size 12KB
                                                                                                                                            • SHA256 2b7f94d4835e3694404b229a8ae3319f8e8e83bd432ad873b8a3e22863b1e152
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Secure Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                            • Size 11KB
                                                                                                                                            • SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                            • Size 72B
                                                                                                                                            • SHA256 20b359a80bf1c94d30f25cb1339b074732a6ee6ca7ffd4ba82a49edba5c226fa
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 72B
                                                                                                                                            • SHA256 d8c0e8eaca31cfd4014d492023991acbb2661cffcc520522e6e31fc0f4db630c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index~RFe5afbf5.TMP
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5afbf5.TMP
                                                                                                                                            • Size 48B
                                                                                                                                            • SHA256 9ca3c3a95fd89aa428efc75ed832ad97878f347c7e4b512ca726a77a374b62b5
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            data_0
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                            Submit Download

                                                                                                                                            data_1
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                                                                            • Size 264KB
                                                                                                                                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                            Submit Download

                                                                                                                                            data_2
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                            Submit Download

                                                                                                                                            data_3
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                            Submit Download

                                                                                                                                            MANIFEST-000001
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                            • Size 41B
                                                                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
                                                                                                                                            • Size 111B
                                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State~RFe5b23c1.TMP
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b23c1.TMP
                                                                                                                                            • Size 59B
                                                                                                                                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 129KB
                                                                                                                                            • SHA256 852f9a5b3459506c42e3b58795e929f29bd2d66cb18d2f26e198cedee53855d4
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 129KB
                                                                                                                                            • SHA256 d2841fb7a3eb1c9bc1e9c1ece1ee2a5376ea0c43014d4ffde7d6795d8adbb29f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 129KB
                                                                                                                                            • SHA256 adeea614e9da89836e8774a1dc29e396bc2d55400feba6105a15829494d748f8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 029852a4b488e079e2f7f7b8bc73d9e5799ed928cb3ea3d0183d3f0bdb48c5cb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            globalConfig[1].json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4T9GJRJX\globalConfig[1].json
                                                                                                                                            • Size 11KB
                                                                                                                                            • SHA256 1f5ee590c10c10b7af2cdb7b3a29f9538d0b7c752edc9bbdb876d21e2dd7dc6b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            EA_app_20260903160516_000_EAapp_13.783.0.6296_d09621539_b197ac3e_15340466.msi.log
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EA_app_20260903160516_000_EAapp_13.783.0.6296_d09621539_b197ac3e_15340466.msi.log
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 b4f7d1b7faf42a874cf219fd1ac780de525e40ea4491e8bffd275647c48b9dbf
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            __PSScriptPolicyTest_dhgrstry.pi2.ps1
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhgrstry.pi2.ps1
                                                                                                                                            • Size 60B
                                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            messages.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1296_1357959961\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                            • Size 450B
                                                                                                                                            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            bf4cfeb2f50eb4d5.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\bf4cfeb2f50eb4d5.customDestinations-ms
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 74df6696fc8059e4f2115c7b944b66d21c70166ccc4e978b618f0b631e3f938a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            bf4cfeb2f50eb4d5.customDestinations-ms
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\bf4cfeb2f50eb4d5.customDestinations-ms
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 98e1e50e13a4def54af05394594a88127a55f22b587aeb7686c1c51167777ce0
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Unconfirmed 58794.crdownload
                                                                                                                                            • Path C:\Users\Admin\Downloads\Unconfirmed 58794.crdownload
                                                                                                                                            • Size 2.0MB
                                                                                                                                            • SHA256 0a97e09a026b3f915edf827e1efadb1b400c09c06c2918fce6edf6194b4c781f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MSI80B6.tmp
                                                                                                                                            • Path C:\Windows\Installer\MSI80B6.tmp
                                                                                                                                            • Size 211KB
                                                                                                                                            • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MSI9104.tmp
                                                                                                                                            • Path C:\Windows\Installer\MSI9104.tmp
                                                                                                                                            • Size 256KB
                                                                                                                                            • SHA256 679d7d0427a6e2d482aab39f5a0d5a6ccc7a4f69537baf5e252b79a505347fd7
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                            • Path C:\Windows\Installer\MSI9104.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                            • Size 179KB
                                                                                                                                            • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            juno-custom-actions.dll
                                                                                                                                            • Path C:\Windows\Installer\MSI9104.tmp-\juno-custom-actions.dll
                                                                                                                                            • Size 48KB
                                                                                                                                            • SHA256 d9574f5630535dd556f075b82a59e97f8738ae1cfa3d47ec7ee3eb9866de6b0a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            CustomAction.config
                                                                                                                                            • Path C:\Windows\Installer\MSIA633.tmp-\CustomAction.config
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 5d0428dac1fff42a4c0bec48cd7c65ebf2a5c876871393fb15ffeea2d1f3735d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            juno-bootstrapper-application.dll
                                                                                                                                            • Path C:\Windows\Temp\{324DD80C-73E3-431B-8DBD-EFE11854ED32}\.ba\juno-bootstrapper-application.dll
                                                                                                                                            • Size 3.1MB
                                                                                                                                            • SHA256 30d2217594646a545c4a8d093bf0f65eaa7721ccf020721817ca3a0397b9a5e8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            memory/620-2204-0x0000000074130000-0x000000007444A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2876-1158-0x0000000003770000-0x0000000003780000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2876-1154-0x0000000003720000-0x000000000374E000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2436-0x000001E3FCD70000-0x000001E3FCD71000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2442-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2421-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2420-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2419-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2418-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2417-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2416-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2415-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2414-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2413-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2412-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2411-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2410-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2408-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2407-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2406-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2405-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2404-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2403-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2402-0x000001E3FC4E0000-0x000001E3FC4E1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2401-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2400-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2399-0x000001E3FC4E0000-0x000001E3FC4E1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2430-0x000001E3FCD50000-0x000001E3FCD53000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2432-0x000001E3FCD60000-0x000001E3FCD62000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2434-0x000001E3FCD70000-0x000001E3FCD71000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2424-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2437-0x000001E3FCD60000-0x000001E3FCD62000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2438-0x000001E3FCD60000-0x000001E3FCD62000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2423-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2439-0x000001E3FCD60000-0x000001E3FCD62000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2450-0x000001E3FCD80000-0x000001E3FCD81000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2440-0x000001E3FCD60000-0x000001E3FCD62000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2443-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2444-0x000001E3FCD50000-0x000001E3FCD53000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2445-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2446-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2447-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2448-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2441-0x000001E3FCD50000-0x000001E3FCD53000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2451-0x000001E3FCD80000-0x000001E3FCD81000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2452-0x000001E3FCD80000-0x000001E3FCD81000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2453-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2435-0x000001E3FCD70000-0x000001E3FCD71000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2428-0x000001E3FCD50000-0x000001E3FCD53000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2409-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2395-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2396-0x000001E3FC4C0000-0x000001E3FC4C1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2398-0x000001E3FC4E0000-0x000001E3FC4E1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2237-0x000001E3FAB30000-0x000001E3FAD30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2235-0x000001E3FA6F0000-0x000001E3FAB30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2205-0x00007FF62F8C0000-0x00007FF631762000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2425-0x000001E3FCD30000-0x000001E3FCD32000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2426-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2203-0x00007FF8E50D0000-0x00007FF8E54EB000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2198-0x00007FF8E4B70000-0x00007FF8E50CF000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2429-0x000001E3FCD50000-0x000001E3FCD53000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3652-2427-0x000001E3FCD40000-0x000001E3FCD41000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5040-2-0x000001BA3CD50000-0x000001BA3CD72000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5428-1127-0x00000000706D0000-0x00000000709EA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5940-2231-0x00007FF62F8C0000-0x00007FF631762000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5940-2230-0x00007FF8E50D0000-0x00007FF8E54EB000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5940-2229-0x00007FF8E4B70000-0x00007FF8E50CF000-memory.dmp
                                                                                                                                            Download