Overview

overview

10

Static

static

5

nixware.exe

windows10-ltsc_2021-x64

10

nixware.exe

windows10-2004-x64

10

nixware.exe

windows11-21h2-x64

10

nixware.exe

windows11-ltsc_2024-x64

10

Resubmissions

11/10/2026, 12:19

261011-phackshf4910

11/10/2026, 12:19

261011-pg9q2s1tbz10

11/10/2026, 12:19

261011-pg9faahy7z10

11/10/2026, 12:19

261011-pg85hshf4510

11/10/2026, 12:19

261011-pg8tra1tby10

11/10/2026, 12:19

261011-pg8hzshf4410

11/10/2026, 12:19

261011-pg778a1tbx10

11/10/2026, 12:19

261011-pg7xfshf4310

11/10/2026, 12:11

261011-pcr1fahy2y10

11/10/2026, 12:11

261011-pcrpnshe7710

Analysis

  • max time kernel
    884s
  • max time network
    905s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-uk
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nixware.exe
  • Size 839KB
  • Sample261011-phackshf49
  • SHA256 566dbb38b2fcc28af2f756a374662e1b9c94e9b97211d0ca80a1d322f5d1c0cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 32 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Windows directory 13 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 35 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 60 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 34 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nixware.exe
    "C:\Users\Admin\AppData\Local\Temp\nixware.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6020
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name="|T}@.uP".}(d.X" dir=in action=allow program="C:\Windows\windows.exe" enable=yes & exit
      2⤵
        PID:5316
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5116
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6028
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3464
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /C taskkill /im explorer.exe /f > NUL 2>&1 && timeout /t 3 /nobreak > NUL && start explorer.exe
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6092
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Loads dropped DLL
          • Kills process with taskkill
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:944
        • C:\Windows\system32\timeout.exe
          timeout /t 3 /nobreak
          3⤵
          • Loads dropped DLL
          • Delays execution with timeout.exe
          • Suspicious behavior: EnumeratesProcesses
          PID:4484
        • C:\Windows\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Loads dropped DLL
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RevokeUnregister.mhtml
            4⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3100
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc5dd7c188,0x7ffc5dd7c194,0x7ffc5dd7c1a0
              5⤵
              • Loads dropped DLL
              PID:5784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,7876308582893317347,1424307501425281038,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
              5⤵
              • Loads dropped DLL
              • System Time Discovery
              PID:4444
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,10813934161857904565,9256543915031828080,262144 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
              5⤵
                PID:2408
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,1394329144635151851,5446312259287090960,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
                5⤵
                  PID:3476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,7459162403433316834,4798597403464354827,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
                  5⤵
                    PID:708
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,5793562634287871625,11882311648741570331,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
                    5⤵
                      PID:3960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,4050415350720755768,4724498730677258318,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                      5⤵
                        PID:3184
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8225254429599971375,6140205376744702129,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
                        5⤵
                          PID:2788
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3904,i,11121442512843506046,7412962639344818163,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
                          5⤵
                            PID:3896
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17208033849159943225,10028240946227890847,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
                            5⤵
                              PID:3784
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4018859858266155330,6239193320431358569,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                              5⤵
                                PID:5216
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11072510158225557791,752337970701397771,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
                                5⤵
                                  PID:1396
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7853488446087936812,543864728315250328,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                                  5⤵
                                    PID:2016
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7853488446087936812,543864728315250328,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                                    5⤵
                                      PID:908
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,15566212916069193784,12302414604791491630,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                      5⤵
                                        PID:4688
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,1333059340722432628,14444096820043461123,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
                                        5⤵
                                          PID:1288
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6652,i,2125369916316017138,6762282766005102182,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
                                          5⤵
                                            PID:4332
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6628,i,17154117578764602751,2993951985059725609,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
                                            5⤵
                                              PID:4684
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7068,i,8770352561062781886,6403062993815856343,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
                                              5⤵
                                                PID:936
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7212,i,1094913735589668904,8637252119941378716,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
                                                5⤵
                                                  PID:3272
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7360,i,14304363905722289015,6089533924408810623,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
                                                  5⤵
                                                    PID:4172
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5304,i,10339201740683185108,439407387398876298,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
                                                    5⤵
                                                      PID:4924
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,12839101300366994116,7256058513898989586,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:12
                                                      5⤵
                                                        PID:2536
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7420,i,2991141792949305189,16053052620198165101,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
                                                        5⤵
                                                          PID:3800
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7736,i,14168349171156835567,2842916857353443951,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
                                                          5⤵
                                                            PID:2476
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7028,i,7795304782611375951,18121008481702384603,2097152 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
                                                            5⤵
                                                              PID:2784
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,13679733573960983501,11305674932490912017,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
                                                              5⤵
                                                                PID:4780
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7592,i,1957685757069442955,17603297854870425185,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:14
                                                                5⤵
                                                                  PID:4232
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,7832771765309151023,3263819701432976303,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:14
                                                                  5⤵
                                                                    PID:812
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,9988035340732593497,10400417749622519530,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
                                                                    5⤵
                                                                      PID:6440
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,6858494742617482370,16050702698713070507,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14
                                                                      5⤵
                                                                        PID:5872
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,13245315661811375122,7024995524534902935,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
                                                                        5⤵
                                                                          PID:3736
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1669390883266137793,17932584408167740765,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:14
                                                                          5⤵
                                                                            PID:4676
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7768,i,4555536951157899458,5481508142737916956,262144 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:10
                                                                            5⤵
                                                                              PID:4808
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7630290261933809919,2837122010156479378,524288 --field-trial-handle=2588,i,43267873649838144,4705309732933581581,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
                                                                              5⤵
                                                                                PID:7020
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RevokeUnregister.mhtml
                                                                              4⤵
                                                                              • Enumerates system info in registry
                                                                              PID:6520
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc5dd7c188,0x7ffc5dd7c194,0x7ffc5dd7c1a0
                                                                                5⤵
                                                                                  PID:6956
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,9014457882278016526,11797460259886966954,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
                                                                                  5⤵
                                                                                  • System Time Discovery
                                                                                  PID:5988
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,8256544703424388089,53472264795673430,262144 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
                                                                                  5⤵
                                                                                    PID:7136
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,6378667078428678177,10980053285541792860,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
                                                                                    5⤵
                                                                                      PID:7040
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2421436054394944173,7386458914224469482,2097152 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
                                                                                      5⤵
                                                                                        PID:5436
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5759671918952346796,10627214837299152099,2097152 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
                                                                                        5⤵
                                                                                          PID:5484
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3580,i,14692727185610613268,2386834605280856269,2097152 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
                                                                                          5⤵
                                                                                            PID:4588
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,109722889834449980,11370977044464111497,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
                                                                                            5⤵
                                                                                              PID:5404
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4957726833452256671,1200083228241538512,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
                                                                                              5⤵
                                                                                                PID:1404
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6747792930225408787,9020542824264639743,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:1748
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6747792930225408787,9020542824264639743,524288 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:3608
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6052,i,1473998187479228437,8657527156718597998,2097152 --field-trial-handle=2604,i,13274916506269603983,12545750007889470257,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
                                                                                                    5⤵
                                                                                                      PID:6220
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5832
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1728
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4820
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:4928
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3864
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:3976
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5444
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2876
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3156
                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4560
                                                                                            • C:\Windows\windows.exe
                                                                                              "C:\Windows\windows.exe"
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Accesses Microsoft Outlook profiles
                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                              • Checks processor information in registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              • outlook_office_path
                                                                                              • outlook_win_path
                                                                                              PID:2444
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3116
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1800
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4824
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:8
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2724
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2940
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2184
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5468
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3472
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5700
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4704
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:3236
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2576
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2992
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3188
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:4324
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3860
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2044
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6056
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:4616
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5240
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1820
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4732
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:3416
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1884
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1344
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6132
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1780
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1480
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:3620
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3584
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:4052
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4428
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5864
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3740
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2548
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:472
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2492
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:700
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2992
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:464
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:988
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:2672
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  3⤵
                                                                                                    PID:812
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2336
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:6840
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:6876
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:5388
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:1900
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:6868
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4384
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:2632
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:248
                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                  "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_9dd05dae6bec45788efed3eabdd615d7"
                                                                                                  2⤵
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  PID:5448
                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                  "netsh" wlan show profiles
                                                                                                  2⤵
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                  PID:3272
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:4184
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:1296
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST & exit
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:4072
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\windows.exe" /RL HIGHEST
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:6852
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:816
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5028
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3496
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1516
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5424
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4752
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4608
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5944
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2832
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1476
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                1⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:3844
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4308
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2844
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:4220
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:3444
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:1708
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:5104
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:2128
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:2536
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:3312
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:3416
                                                                                              • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                1⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:1532
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:5992
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:2548
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:2808
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                1⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:1124
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:6708
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:6728
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:6412
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:3792
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:4280
                                                                                              • C:\Windows\windows.exe
                                                                                                "C:\Windows\windows.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                PID:5752
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:4336
                                                                                                • C:\Windows\windows.exe
                                                                                                  "C:\Windows\windows.exe"
                                                                                                  1⤵
                                                                                                    PID:3364

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Command and Scripting Interpreter

                                                                                                        1
                                                                                                        T1059

                                                                                                        Windows Command Shell

                                                                                                        1
                                                                                                        T1059.003

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Persistence

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        2
                                                                                                        T1547

                                                                                                        Active Setup

                                                                                                        1
                                                                                                        T1547.014

                                                                                                        Winlogon Helper DLL

                                                                                                        1
                                                                                                        T1547.004

                                                                                                        Event Triggered Execution

                                                                                                        2
                                                                                                        T1546

                                                                                                        AppInit DLLs

                                                                                                        1
                                                                                                        T1546.010

                                                                                                        Netsh Helper DLL

                                                                                                        1
                                                                                                        T1546.007

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Privilege Escalation

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        2
                                                                                                        T1547

                                                                                                        Active Setup

                                                                                                        1
                                                                                                        T1547.014

                                                                                                        Winlogon Helper DLL

                                                                                                        1
                                                                                                        T1547.004

                                                                                                        Event Triggered Execution

                                                                                                        2
                                                                                                        T1546

                                                                                                        AppInit DLLs

                                                                                                        1
                                                                                                        T1546.010

                                                                                                        Netsh Helper DLL

                                                                                                        1
                                                                                                        T1546.007

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Defense Evasion

                                                                                                        Modify Registry

                                                                                                        3
                                                                                                        T1112

                                                                                                        Credential Access

                                                                                                        Credentials from Password Stores

                                                                                                        1
                                                                                                        T1555

                                                                                                        Credentials from Web Browsers

                                                                                                        1
                                                                                                        T1555.003

                                                                                                        Unsecured Credentials

                                                                                                        2
                                                                                                        T1552

                                                                                                        Credentials In Files

                                                                                                        1
                                                                                                        T1552.001

                                                                                                        Credentials in Registry

                                                                                                        1
                                                                                                        T1552.002

                                                                                                        Discovery

                                                                                                        Browser Information Discovery

                                                                                                        1
                                                                                                        T1217

                                                                                                        Peripheral Device Discovery

                                                                                                        2
                                                                                                        T1120

                                                                                                        Query Registry

                                                                                                        6
                                                                                                        T1012

                                                                                                        System Information Discovery

                                                                                                        4
                                                                                                        T1082

                                                                                                        System Network Configuration Discovery

                                                                                                        3
                                                                                                        T1016

                                                                                                        Internet Connection Discovery

                                                                                                        1
                                                                                                        T1016.001

                                                                                                        Wi-Fi Discovery

                                                                                                        1
                                                                                                        T1016.002

                                                                                                        System Time Discovery

                                                                                                        1
                                                                                                        T1124

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Data from Local System

                                                                                                        2
                                                                                                        T1005

                                                                                                        Email Collection

                                                                                                        1
                                                                                                        T1114

                                                                                                        Command and Control

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        046d89cd-b383-4836-baaa-2a9e2f50b60b.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\046d89cd-b383-4836-baaa-2a9e2f50b60b.tmp
                                                                                                        • Size 392B
                                                                                                        • SHA256 2ee5649d7ca0db8f6222a909ff7228a4fac4b1b6fb5752efba9fe14c620988dc
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        20ddee14-f1e0-42c6-beaa-3b88d648676b.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20ddee14-f1e0-42c6-beaa-3b88d648676b.tmp
                                                                                                        • Size 37KB
                                                                                                        • SHA256 c7cc0fc1b2632828fd91ce8ca638ac57545ede4bfc527cd70989c9a4a6fd8367
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        7beefb11-b5de-43ba-9b97-843d58cc55fa.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7beefb11-b5de-43ba-9b97-843d58cc55fa.tmp
                                                                                                        • Size 34KB
                                                                                                        • SHA256 ae6ec860d555c4ac72386abe2518c888920f88c7e97c91285b975e3dc168647a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 1079730bc31a8cea061fc925cc1228e54d9ef77dc4c42de929cd19d90884a82c
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 578f9103f8fec32d5872a45b17fbc8a54942722806021bd02b7843d7f6ce5d06
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        0a08d46d-2c22-4bea-bd88-0e0542f4e5b8.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a08d46d-2c22-4bea-bd88-0e0542f4e5b8.tmp
                                                                                                        • Size 17KB
                                                                                                        • SHA256 d91c2f851fb4e232445b656d762e872a2d121f12f6d14ff62c1fc9c8f887ff47
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        12257967-c503-4fd3-b5be-69ae9a1c0247.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12257967-c503-4fd3-b5be-69ae9a1c0247.tmp
                                                                                                        • Size 414B
                                                                                                        • SHA256 17fed89ccb6b608bfca42328b72046c277a80ead8f7f668cbe57e5231d57b707
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        3879b25a-059f-4ca5-9f1b-48cafe5e865c.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3879b25a-059f-4ca5-9f1b-48cafe5e865c.tmp
                                                                                                        • Size 19KB
                                                                                                        • SHA256 8c1874ea348e42fe0f3b71d539aa7e9c8d694e0ef8ff909ecb023bfd22e55bbf
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        67f92b97-6bd0-4181-81b6-7d05ac963d8b.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67f92b97-6bd0-4181-81b6-7d05ac963d8b.tmp
                                                                                                        • Size 29KB
                                                                                                        • SHA256 a6997bdd7441c6cca60e4636b342b178ca60b6de02f2c8c8f320e1794ba0f305
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        7e18e084-b57f-4e3f-93e9-f34efb1ebc1f.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e18e084-b57f-4e3f-93e9-f34efb1ebc1f.tmp
                                                                                                        • Size 6B
                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        86390cc2-20ae-4a71-afcd-3347fe6e6032.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86390cc2-20ae-4a71-afcd-3347fe6e6032.tmp
                                                                                                        • Size 18KB
                                                                                                        • SHA256 459ed7716a0bfcdabbf149428c042c65043901245923fc62285a4d1fef0762d4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00005d
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
                                                                                                        • Size 70KB
                                                                                                        • SHA256 d0d5efffc11f7135d12e78e818514c0765f3641eddc772f7aee91941311065d9
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00005e
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
                                                                                                        • Size 418KB
                                                                                                        • SHA256 98c08e3565011a8bb5fed44dfa363ba5f43bc96625c7765ddc44ba198cc0ddba
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00005f
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
                                                                                                        • Size 206KB
                                                                                                        • SHA256 924b874d6353f03744efb96b5d1a66e5067e9b8f7a5ea710c7aed5081bf297e3
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000060
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
                                                                                                        • Size 27KB
                                                                                                        • SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000061
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
                                                                                                        • Size 78KB
                                                                                                        • SHA256 c51d9e869e0c0c33890c49481966936f532a51f5060466c976529108d66e82a9
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000062
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
                                                                                                        • Size 256KB
                                                                                                        • SHA256 1a51a39a0181abb211af41600112378aa74b3c924fcb662ebd001a647233107d
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000063
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                                                        • Size 17KB
                                                                                                        • SHA256 470590f125d0196bc9096c2f18d15eb3e4572a94c15df36524188a85595dbf71
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000064
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                        • Size 56KB
                                                                                                        • SHA256 3e3a5b7df892755aad0f7c837cda65543935c2e1d5dd3a0389d2227b27b3c783
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000065
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
                                                                                                        • Size 59KB
                                                                                                        • SHA256 484fed28305e8a1256870a26f905be957ee23b5c5dc9c0daa5b01435e7de3408
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000066
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
                                                                                                        • Size 46KB
                                                                                                        • SHA256 d83011dcc82e375289881129c89f88ed30a22897b5ccc35345ec2633d36722f1
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000068
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
                                                                                                        • Size 256KB
                                                                                                        • SHA256 542ac655cca6f4835f0752937b8144fa3620dfec1b42b5277470217010a621c0
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000069
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
                                                                                                        • Size 72KB
                                                                                                        • SHA256 fcfaf2e8e1a5d8cff6e2c7736a10a6a3faf27d4696d5d4bf1e2d34cf3512b5e0
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00006c
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                                                        • Size 71KB
                                                                                                        • SHA256 d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00006d
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
                                                                                                        • Size 256KB
                                                                                                        • SHA256 ef389287b32b215ab2e1831b8baed478f94246cafb0528c444a34008bd45096d
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00006e
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                        • Size 256KB
                                                                                                        • SHA256 058eb9674b820893fff9e55cfe93bd695bd889d05f0f90334d3b989715777d83
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_00006f
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
                                                                                                        • Size 17KB
                                                                                                        • SHA256 c626f513876dd0e5692a93e2da8bb75c0708e6e8c1ff2b908ae40409cf7251a5
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000070
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                                                        • Size 19KB
                                                                                                        • SHA256 c64c67529ad8eb12e8dbaf84ed7b0e6b54083fff315147771a92f7eb2d3ffdad
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000071
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                                                        • Size 20KB
                                                                                                        • SHA256 25acec5db0baf3c006e081eb3a35df762004e315fdd2bf5c842d8ceac59efb0c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000072
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
                                                                                                        • Size 23KB
                                                                                                        • SHA256 4277206b66e29ca6df2749283d11bc39747327a7dcf60a4ae81a7f08afb4588c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000075
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
                                                                                                        • Size 60KB
                                                                                                        • SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000076
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
                                                                                                        • Size 68KB
                                                                                                        • SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000077
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                        • Size 19KB
                                                                                                        • SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000078
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
                                                                                                        • Size 65KB
                                                                                                        • SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_000079
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
                                                                                                        • Size 45KB
                                                                                                        • SHA256 9f85b3224b1f8b66cbf16258825f21b0eb92c4cee6267d54bf39cc34ed4a1a7d
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000a5
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
                                                                                                        • Size 251KB
                                                                                                        • SHA256 b4d57d153f048d270cd81f91c04777a1c3486ff4ee2e98e2074a977f24590d2b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000a6
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
                                                                                                        • Size 38KB
                                                                                                        • SHA256 a9fe148482dbbd2cdd9f2eb16500598fd367268cc6cbc53c08668298cf339b00
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000ac
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
                                                                                                        • Size 1024KB
                                                                                                        • SHA256 0da8936b059829d6c75891350d6dcfc044b887b41ceb2e7507d2d1368efb1a85
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000b7
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
                                                                                                        • Size 106KB
                                                                                                        • SHA256 d444aeb6a6e581ac69f7b64f69ea7f4f6c0addea2ed216fa23799449c831ca07
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000bb
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
                                                                                                        • Size 39KB
                                                                                                        • SHA256 ec84c60f4d537b060a76931a7bd5eb5e0127b2c85d48508ebddf525b5935b958
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000bc
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
                                                                                                        • Size 16KB
                                                                                                        • SHA256 13125c6bbbcc02f9012041ba28a0293d69ed69c35e32ee56226ac5af30e0874a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000bd
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
                                                                                                        • Size 16KB
                                                                                                        • SHA256 8463ed535eccb85e24c0d668a6055b3148777528304e8c9f8d510be0628c0467
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f_0000be
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
                                                                                                        • Size 45KB
                                                                                                        • SHA256 7fda544da377f78a71b3e39b5cc91ed47949f7bf15e68a482ea7e82f88e916ec
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        temp-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                        • Size 5KB
                                                                                                        • SHA256 97e1f8e0d14549e3b03f517bbc1d6c8eba012ff5679c4a10ab8f3a8def7b5a4e
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                        • Size 2KB
                                                                                                        • SHA256 244bcda6e7e6027421b2ac24bb75955b875c0593821590cdb5f07b6c7157d4e4
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        d71411f3-e73f-4615-90e9-0fb48563ff88.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d71411f3-e73f-4615-90e9-0fb48563ff88.tmp
                                                                                                        • Size 2B
                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        0aa3a485-6399-4598-87b1-1123feced526.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0aa3a485-6399-4598-87b1-1123feced526.tmp
                                                                                                        • Size 2B
                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        610d403b-8301-4936-b57a-05bdc6cd7292.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\610d403b-8301-4936-b57a-05bdc6cd7292.tmp
                                                                                                        • Size 40B
                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        799f21ae-f5dd-4206-b064-e5e71e44b6e7.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\799f21ae-f5dd-4206-b064-e5e71e44b6e7.tmp
                                                                                                        • Size 211B
                                                                                                        • SHA256 83d1aa312e7becd053effc194ee08fdce7da9ed0b421d459df81ba54d1603330
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        a2715bcc-e7cd-4bc7-8e3d-243e5c9417b6.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2715bcc-e7cd-4bc7-8e3d-243e5c9417b6.tmp
                                                                                                        • Size 10KB
                                                                                                        • SHA256 997fc18d6f8e597543ccd7c077c61267b7f0e3893d1a5bbe1dedbe239170fc23
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        temp-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\temp-index
                                                                                                        • Size 3KB
                                                                                                        • SHA256 76325f993b80c7923f6f3b765607920bd4e4f5f009a33c0fbc74d7f88ef0ebcd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        index.txt.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                        • Size 371B
                                                                                                        • SHA256 e3d92a69540057f9893b6efd8a678a91fb2e4e2a0be8d98d4486acac211f283e
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        index.txt.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                        • Size 519B
                                                                                                        • SHA256 3f8f17be20beb7569789e250aa4d3fe643d7bec6a3555a9f96890d4b038ac42f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        temp-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                                                                        • Size 96B
                                                                                                        • SHA256 88a78bc7956e35868dbafc516d2a652db40152c0b50ba2401fd8d2e461ddc24f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                        • Size 48B
                                                                                                        • SHA256 43e1d4c72f3a4f6236d2e47c6cd8635ba58de7bb380ec431a87075e64ae5d3a1
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        sync_diagnostic.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                        • Size 4KB
                                                                                                        • SHA256 cfd7e830cca767ed86f6b54fe9f8e3ade3011c7971145b935786a178079b9c0f
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        d46a64fc-f4ef-48ae-8d46-2d93c849e546.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d46a64fc-f4ef-48ae-8d46-2d93c849e546.tmp
                                                                                                        • Size 70KB
                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        e5fb827e-3797-4fa7-88bb-6c9601c5e2ce.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5fb827e-3797-4fa7-88bb-6c9601c5e2ce.tmp
                                                                                                        • Size 16KB
                                                                                                        • SHA256 6f44b519807eb56abd64858e5cb50d0f44f584f75e621bc7ec6ae77bd83497f6
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f3ceea4e-b880-4365-baed-85cf74513a9d.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3ceea4e-b880-4365-baed-85cf74513a9d.tmp
                                                                                                        • Size 11KB
                                                                                                        • SHA256 41532d548a03f53de5aabf85332a752a4e9f9c055ca83ce8319087033b61482b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        23c52380-77be-43a4-a27f-2726b6df0716.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\23c52380-77be-43a4-a27f-2726b6df0716.tmp
                                                                                                        • Size 22KB
                                                                                                        • SHA256 6e58e69a07fdfb27891cfa9a663b1cd3f76e4a77ea6f312fab0beb3b92ffb513
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        RevisitationBloomfilter
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                        • Size 392B
                                                                                                        • SHA256 5f52d36ad205c3eadf82a60d9c9f4c5a2a581e47d58c4d18bd805acb4f13b261
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        349aa326-cd1e-4322-81be-869f883a0092.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\349aa326-cd1e-4322-81be-869f883a0092.tmp
                                                                                                        • Size 372B
                                                                                                        • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        7a971e07-f34b-4e94-addb-c71d7544ebda.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7a971e07-f34b-4e94-addb-c71d7544ebda.tmp
                                                                                                        • Size 132B
                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        c00594f3-559f-4add-9f15-fbffb26e0d3e.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c00594f3-559f-4add-9f15-fbffb26e0d3e.tmp
                                                                                                        • Size 492B
                                                                                                        • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        d15888db-f4ae-453c-a2f0-ec81b937c20f.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d15888db-f4ae-453c-a2f0-ec81b937c20f.tmp
                                                                                                        • Size 252B
                                                                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        d035c9e9-d6af-49ea-b78b-6744f65546dc.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d035c9e9-d6af-49ea-b78b-6744f65546dc.tmp
                                                                                                        • Size 34KB
                                                                                                        • SHA256 dbd58778d689fdc94597f39dc4a29d0451c35ce1b3f400fb94d7d9c6c55a8193
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ef651cdd-e6fc-441b-ae56-781adc898c90.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef651cdd-e6fc-441b-ae56-781adc898c90.tmp
                                                                                                        • Size 42KB
                                                                                                        • SHA256 6f23bf474f88b4e6cb78e4fa05a2a894762856891aa0654cc6e2254e445034fa
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        37755767-7154-4286-9720-360d5118c03e.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\37755767-7154-4286-9720-360d5118c03e.tmp
                                                                                                        • Size 13B
                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        prep_Activatable Class_Hermes_perf.cache
                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                        • Size 599B
                                                                                                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        82c9c23e-1aa0-467c-ab71-d5630f9ade63.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\82c9c23e-1aa0-467c-ab71-d5630f9ade63.tmp
                                                                                                        • Size 1B
                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        b8a644c5-f1fe-443b-bfdf-d4838f017d3f.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b8a644c5-f1fe-443b-bfdf-d4838f017d3f.tmp
                                                                                                        • Size 10KB
                                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        content.js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3100_1039352653\CRX_INSTALL\content.js
                                                                                                        • Size 9KB
                                                                                                        • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1181598141\manifest.json
                                                                                                        • Size 43B
                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1515303746\manifest.json
                                                                                                        • Size 165B
                                                                                                        • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_578992630\manifest.json
                                                                                                        • Size 160B
                                                                                                        • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_600625182\manifest.json
                                                                                                        • Size 135B
                                                                                                        • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        windows.exe
                                                                                                        • Path C:\Windows\windows.exe
                                                                                                        • Size 839KB
                                                                                                        • SHA256 566dbb38b2fcc28af2f756a374662e1b9c94e9b97211d0ca80a1d322f5d1c0cb
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        xdwd.dll
                                                                                                        • Path C:\Windows\xdwd.dll
                                                                                                        • Size 136KB
                                                                                                        • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        memory/2444-1882-0x0000017D7ADA0000-0x0000017D7ADF0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2444-358-0x0000017D7ABA0000-0x0000017D7AC6A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2444-1881-0x0000017D1A7D0000-0x0000017D1A816000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4560-93-0x0000016C98FD0000-0x0000016C98FF0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4560-79-0x0000016495800000-0x0000016495900000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4560-125-0x0000016CAAB80000-0x0000016CAABA0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4560-94-0x0000016CAA530000-0x0000016CAA630000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4560-111-0x0000016C9A4B0000-0x0000016C9A4D0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-8-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-83-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-54-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-6-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-5-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-4-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-7-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-1-0x000001A3A84D0000-0x000001A3A85A4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-3-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-2-0x00007FFC5A320000-0x00007FFC5ACC4000-memory.dmp
                                                                                                        Download

                                                                                                        memory/6020-0-0x00007FFC5A4AF000-0x00007FFC5A4B0000-memory.dmp
                                                                                                        Download