asyncrat | b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/11/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Size 1.2MB
Sample261106-gqmc4sty5l
SHA256 b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37
MD5 ee1091142cd35743eb5e56d8135011f2
SHA1 a14babcd5f0e92ffd1186fad7987aadffd469e18
SHA512 a2e2c956ebc52571fad6bb5fd2f259692f2e12305020e442e6de9c2e5af1ea1c0dd227e3708ef66d9938f1b544a86ef0f34d664ae58d0a1dc3f3a7be6217fb69
SSDEEP 24576:4hcenxxNXXnQybuO5Eogxu+Vx0d4R+frPkIKbvTKm9b6i:8ciZXnQyCaeu+f0uuPkt7uY
TLSH
T16945F004A659B4D8E46645F385C2375CAA76BE0072C01DDA2EDF72746E32BD0EDEBE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked credential_access defense_evasion discovery execution asyncrat njrat stormkitty xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

196.251.107.58:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000300000001a21c-1311.dat	family_asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a21b-1305.dat	family_xworm
behavioral2/memory/4540-1307-0x0000000000FB0000-0x0000000000FEC000-memory.dmp	family_xworm

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a21c-1311.dat	family_stormkitty
behavioral2/memory/2160-1313-0x00000000007C0000-0x0000000000AFC000-memory.dmp	family_stormkitty

Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 23 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3676 created 4544	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	99
PID 3676 created 3832	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	100
PID 3676 created 5696	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	102
PID 3676 created 3008	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	101
PID 3676 created 4828	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	104
PID 3676 created 4612	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	105
PID 3676 created 6092	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	106
PID 3676 created 4544	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	99
PID 3676 created 4544	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	99
PID 3676 created 5696	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	102
PID 3676 created 5696	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	102
PID 3676 created 4136	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	123
PID 3676 created 3024	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	154
PID 3676 created 4384	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	126
PID 3676 created 4380	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	128
PID 3676 created 4664	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	127
PID 3676 created 4968	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	130
PID 3676 created 2724	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	131
PID 3676 created 3876	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	132
PID 3676 created 4136	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	123
PID 3676 created 4136	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	123
PID 3676 created 4384	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	126
PID 3676 created 4384	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	126

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6456	powershell.exe
2596	powershell.exe
6360	powershell.exe
6796	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
96	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
96	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
96	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	79669c49.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	79669c49.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe	79669c49.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
4540	d1133843.exe
2160	386db5e0.exe
2732	a51f541d.exe
6108	79669c49.exe
356	svchost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe"	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe"	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	79669c49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe"	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe"	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4136_506599595\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1599549511\offscreendocument_main.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4400	cmd.exe
7136	cmd.exe
4664	cmd.exe
5980	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	386db5e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	386db5e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a51f541d.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	chrome.exe
5696	chrome.exe
4384	msedge.exe
2500	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{76EA2ABC-B144-4D09-89A7-5CB74EF27CAD}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe
4112	schtasks.exe
4584	schtasks.exe
1420	schtasks.exe
2040	schtasks.exe
3328	schtasks.exe
1424	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6108	79669c49.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4544	chrome.exe
4544	chrome.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe
2080	chrome.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeCreatePagefilePrivilege	2080	chrome.exe
Token: SeDebugPrivilege	4540	d1133843.exe
Token: SeDebugPrivilege	6456	powershell.exe
Token: SeDebugPrivilege	2160	386db5e0.exe
Token: SeIncreaseQuotaPrivilege	6456	powershell.exe
Token: SeSecurityPrivilege	6456	powershell.exe
Token: SeTakeOwnershipPrivilege	6456	powershell.exe
Token: SeLoadDriverPrivilege	6456	powershell.exe
Token: SeSystemProfilePrivilege	6456	powershell.exe
Token: SeSystemtimePrivilege	6456	powershell.exe
Token: SeProfSingleProcessPrivilege	6456	powershell.exe
Token: SeIncBasePriorityPrivilege	6456	powershell.exe
Token: SeCreatePagefilePrivilege	6456	powershell.exe
Token: SeBackupPrivilege	6456	powershell.exe
Token: SeRestorePrivilege	6456	powershell.exe
Token: SeShutdownPrivilege	6456	powershell.exe
Token: SeDebugPrivilege	6456	powershell.exe
Token: SeSystemEnvironmentPrivilege	6456	powershell.exe
Token: SeRemoteShutdownPrivilege	6456	powershell.exe
Token: SeUndockPrivilege	6456	powershell.exe
Token: SeManageVolumePrivilege	6456	powershell.exe
Token: 33	6456	powershell.exe
Token: 34	6456	powershell.exe
Token: 35	6456	powershell.exe
Token: 36	6456	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4136	msedge.exe
1968	msedge.exe
2080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4692	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	89
PID 3676 wrote to memory of 4112	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	91
PID 4420 wrote to memory of 4584	4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	95
PID 4420 wrote to memory of 1420	4420	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	97
PID 3676 wrote to memory of 4544	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	99
PID 4544 wrote to memory of 3832	4544	chrome.exe	100
PID 4544 wrote to memory of 3008	4544	chrome.exe	101
PID 4544 wrote to memory of 5696	4544	chrome.exe	102
PID 4544 wrote to memory of 3008	4544	chrome.exe	101
PID 4544 wrote to memory of 4612	4544	chrome.exe	105
PID 4544 wrote to memory of 6092	4544	chrome.exe	106
PID 4544 wrote to memory of 4612	4544	chrome.exe	105
PID 4544 wrote to memory of 6092	4544	chrome.exe	106
PID 4544 wrote to memory of 4828	4544	chrome.exe	104
PID 4544 wrote to memory of 4828	4544	chrome.exe	104
PID 4544 wrote to memory of 5876	4544	chrome.exe	107
PID 4544 wrote to memory of 5876	4544	chrome.exe	107
PID 4544 wrote to memory of 5604	4544	chrome.exe	108
PID 4544 wrote to memory of 4832	4544	chrome.exe	109
PID 4544 wrote to memory of 4832	4544	chrome.exe	109
PID 4544 wrote to memory of 4136	4544	chrome.exe	123
PID 4544 wrote to memory of 4136	4544	chrome.exe	123
PID 4544 wrote to memory of 4584	4544	chrome.exe	112
PID 4544 wrote to memory of 4584	4544	chrome.exe	112
PID 4544 wrote to memory of 4684	4544	chrome.exe	114
PID 4544 wrote to memory of 1572	4544	chrome.exe	115
PID 4544 wrote to memory of 4160	4544	chrome.exe	116
PID 4544 wrote to memory of 4684	4544	chrome.exe	114
PID 4544 wrote to memory of 1572	4544	chrome.exe	115
PID 4544 wrote to memory of 4160	4544	chrome.exe	116
PID 4544 wrote to memory of 5764	4544	chrome.exe	118
PID 4544 wrote to memory of 5764	4544	chrome.exe	118
PID 4544 wrote to memory of 5980	4544	chrome.exe	119
PID 4544 wrote to memory of 5980	4544	chrome.exe	119
PID 4544 wrote to memory of 5032	4544	chrome.exe	120
PID 4544 wrote to memory of 5032	4544	chrome.exe	120
PID 4544 wrote to memory of 2172	4544	chrome.exe	121
PID 4544 wrote to memory of 2172	4544	chrome.exe	121
PID 4544 wrote to memory of 4076	4544	chrome.exe	122
PID 4544 wrote to memory of 4076	4544	chrome.exe	122
PID 3676 wrote to memory of 4136	3676	b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe	123
PID 4136 wrote to memory of 3024	4136	msedge.exe	124
PID 4136 wrote to memory of 4384	4136	msedge.exe	126
PID 4136 wrote to memory of 4664	4136	msedge.exe	127
PID 4136 wrote to memory of 4664	4136	msedge.exe	127
PID 4136 wrote to memory of 4380	4136	msedge.exe	128
PID 4136 wrote to memory of 4380	4136	msedge.exe	128
PID 4136 wrote to memory of 4380	4136	msedge.exe	128
PID 4136 wrote to memory of 1576	4136	msedge.exe	129
PID 4136 wrote to memory of 4968	4136	msedge.exe	130
PID 4136 wrote to memory of 1576	4136	msedge.exe	129
PID 4136 wrote to memory of 1576	4136	msedge.exe	129
PID 4136 wrote to memory of 4968	4136	msedge.exe	130
PID 4136 wrote to memory of 4968	4136	msedge.exe	130
PID 4136 wrote to memory of 3876	4136	msedge.exe	132
PID 4136 wrote to memory of 2724	4136	msedge.exe	131
PID 4136 wrote to memory of 3876	4136	msedge.exe	132
PID 4136 wrote to memory of 3876	4136	msedge.exe	132
PID 4136 wrote to memory of 2724	4136	msedge.exe	131
PID 4136 wrote to memory of 2724	4136	msedge.exe	131
PID 4136 wrote to memory of 4576	4136	msedge.exe	133
PID 4136 wrote to memory of 4576	4136	msedge.exe	133
PID 4136 wrote to memory of 4936	4136	msedge.exe	134
PID 4136 wrote to memory of 4936	4136	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
"C:\Users\Admin\AppData\Local\Temp\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Downloads MZ/PE file
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E598998.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4692
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59866D.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ffb4182c728,0x7ffb4182c734,0x7ffb4182c740
    3⤵
    PID:3832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1668,i,10675087296734939308,3923585043033653847,262144 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,3111523781210979533,13416326326467408487,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,5192129151733545760,8261532084786411249,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
    3⤵
    PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,11951482506177423397,14454677720402228216,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,14505729033649618338,11251281890041045814,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,6458512246651415385,2700745284454675533,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,223747962194467884,16110342559817832060,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,655708957591162461,17237665073859227765,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,5637577753381328144,6245072050512075197,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5764,i,18353324231320056217,16498105605580987838,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,140974277523858665,17733267209076161294,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5860,i,12707280204942302868,11732021485381263711,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,14572254425079205275,10405336222213484961,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,9628200001546549614,3251852027095681326,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5884,i,10910603092140371087,17499677703161414021,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5524,i,65822882926352628,5284936994618689365,2097152 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,15192877968692205005,7774962638923767718,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,11673570940744184496,15696590404635496359,524288 --field-trial-handle=2012,i,14195864917526170729,10807691391699788760,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x238,0x268,0x260,0x288,0x7ffb32b4c188,0x7ffb32b4c194,0x7ffb32b4c1a0
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,13860357917678529112,11645857824955854301,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,14614341340909762938,16786281960907168305,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1928,i,7180558426041875274,8130395791409916569,262144 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,15479559541140058130,3407391979664981840,2097152 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,6990706572949538835,11435316702487922288,2097152 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7475679029020087806,10174116405743069532,2097152 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4237142015469334285,11359245205410450390,2097152 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10203294823103700443,11757107410887014282,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7025630289607967791,12332465393134837463,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,18395430027087007376,6606915733739172352,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17836946718495379293,5101163389964450943,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17836946718495379293,5101163389964450943,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,181454922252735199,16417603618736483882,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,1080827259954347422,6139414779397926002,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,4381165572940866909,10720351554124341362,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,16241776231497180829,5773114035838694012,524288 --field-trial-handle=2448,i,2627052693802381988,11180673515453365527,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\loclAp\44e94f3a /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\loclAp\44e94f3a\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\loclAp\44e94f3a --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffb4182c728,0x7ffb4182c734,0x7ffb4182c740
    3⤵
    PID:5480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --force-high-res-timeticks=disabled --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:3216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --force-high-res-timeticks=disabled --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2516 /prefetch:13
    3⤵
    PID:3324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3020 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3048 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3600 /prefetch:9
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\44e94f3a" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2184,i,12065273244424034297,8521474766281449646,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4280 /prefetch:9
    3⤵
    PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\loclAp\d368c527 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\loclAp\d368c527\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c4,0x7ffb369dc188,0x7ffb369dc194,0x7ffb369dc1a0
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2456 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2400 /prefetch:2
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4168 /prefetch:9
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4172 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4492 /prefetch:9
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3412 /prefetch:9
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\d368c527" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2404,i,17848319093353674265,6973444319528892079,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:2056
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\loclAp\4359d42e" about:blank
  2⤵
  PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\loclAp\4359d42e about:blank
    3⤵
    - Checks processor information in registry
    PID:4960
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\ProgramData\5f4e9da9c6a\d1133843.exe"
  2⤵
  - Executes a command shell one-liner
  PID:7136
- - C:\ProgramData\5f4e9da9c6a\d1133843.exe
    "C:\ProgramData\5f4e9da9c6a\d1133843.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\5f4e9da9c6a\d1133843.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:6456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'd1133843.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Google Chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Google Chrome.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6796
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Google Chrome" /tr "C:\Users\Admin\AppData\Roaming\Google Chrome.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\ProgramData\5f4e9da9c6a\386db5e0.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4664
- - C:\ProgramData\5f4e9da9c6a\386db5e0.exe
    "C:\ProgramData\5f4e9da9c6a\386db5e0.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\ProgramData\5f4e9da9c6a\a51f541d.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5980
- - C:\ProgramData\5f4e9da9c6a\a51f541d.exe
    "C:\ProgramData\5f4e9da9c6a\a51f541d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2732
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3328
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\ProgramData\5f4e9da9c6a\79669c49.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4400
- - C:\ProgramData\5f4e9da9c6a\79669c49.exe
    "C:\ProgramData\5f4e9da9c6a\79669c49.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    PID:6108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "WindowsHostProcess" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\loclAp\4359d42e"
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\loclAp\d368c527"
  2⤵
  PID:1928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\loclAp\44e94f3a"
  2⤵
  PID:2512

C:\Users\Admin\AppData\Local\Temp\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
C:\Users\Admin\AppData\Local\Temp\b17c80a5b7e22b98e0688c9e1d8155852380113a2571055c30b0f7719e8bef37.exe
1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5984C4.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4584
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59848A.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4532

C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:356

C:\ProgramData\5f4e9da9c6a\a51f541d.exe
"C:\ProgramData\5f4e9da9c6a\a51f541d.exe" ..
1⤵
PID:6716

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:2376

C:\Users\Admin\AppData\Roaming\Google Chrome.exe
"C:\Users\Admin\AppData\Roaming\Google Chrome.exe"
1⤵
PID:476

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
PID:6864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Indicator Removal

T1070

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

386db5e0.exe

Path C:\ProgramData\5f4e9da9c6a\386db5e0.exe
Size 3.2MB
SHA256 65a036e1d3cec7064225522799cb77357a035e1dc2c0a85179c1602a4800e1d0
MD5 009d3bf2491ee061ddbba9e9e2607018
SHA1 05a232b03a793b68b2897ae41b9ef344fb15e658
SHA512 817ea8ad4daf8e9f685b9cca7a994493e39082187cd5893c4ae99a7ec2c1aeec4b2bf3bafb28a7a35254553df3792d49c01a258554f3356225b3f05a30211fb1
SSDEEP 49152:EQFfDE45ivXPm4w+zJMCzU0hdBdo+6WuDayPYr/NxJ:Ec5wXe4w+B
TLSH
T115F54A41ABF4CE1AE5BF2771E4F200006BB1F499A776D74B6694E6782C627006D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79669c49.exe

Path C:\ProgramData\5f4e9da9c6a\79669c49.exe
Size 115KB
SHA256 bb6c13744aade44a9d1094c2adab042aa42b1f26fb3ea458fe00be87fc55c41a
MD5 2b1d29accb0953e974a302e9e59b57d3
SHA1 d7e5376e711a6e9965b7f3379bdd658209f6349c
SHA512 af68b6349b1f7643634e20c37186977a132bc64d9e91ca5e27474d81b77b5cb29ec5c460d439cdd46d6796b2cb87fd48b6217834855ca1a72a1a3611fa757c02
SSDEEP 1536:HvfJZp5x5J503rHjvbnjK3rHjvbnjV3rHjvbnj3AaA0ova+GLETj19x5N0iH+BOQ:HvMtl9hN0iH+gYQrtUIKR+AeFgYHCVy
TLSH
T1C9C34A1B77E530F8D4B6C678C5610A5ADB72B8350B609FEF03A40A151F236E18D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a51f541d.exe

Path C:\ProgramData\5f4e9da9c6a\a51f541d.exe
Size 43KB
SHA256 1c63d25bce3f93e0061fa153b39501b29059ea22ea58e7102895bf72676a7cff
MD5 848deb9f1ec6a2c6bf7bafec4de18f3b
SHA1 7c5569703369d8a749c061af43aced6d0348e9ec
SHA512 3f191e9f22df78b3a7fb5b20b5d20e664219f29302dc2bc7777e6114f9651657146e56c7e01ad7f4f9e702f407bfb0851656a45b0f945e8517ad303ca34bad63
SSDEEP 384:sZy+iNUst+3gUy6vHPGOmEkjdJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnt/greT0pe:KqwQh6fP9ajWuXQ/oc3+L
TLSH
T1AF13E78CB694E175D5FF8BF1B4A2B2890B71A017A802930FD9F154D94BB3EC09611EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1133843.exe

Path C:\ProgramData\5f4e9da9c6a\d1133843.exe
Size 212KB
SHA256 06b848dd1b9c70fb1ba8956809e15c5883f274f1f512422aa8c51ce3e0e25fa9
MD5 1bbe715a2260e187291fbbbd090a88ca
SHA1 a562d93f6da9de2bcfa89d572110d025b5a11752
SHA512 4d4763db4e5cead1406f483957d053c80b0604fa2922f30f1a3ad26df68c3c519324805b1515fd2a9b35684d7691f0e6baf9be103614e6b5afeb57673a2351dc
SSDEEP 3072:9wFqF1A7SMfl9Ljab5w2YrSFbJ+lG4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvw:6zLM3qIbJ5gVqwlL
TLSH
T14D24195DDEE7B641C14A4876B93393854B7D4E76A4CFB5168EE33FED4AB2C9410030A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2407c6cc-6de5-4a59-abcd-aefa8eab8ea1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2407c6cc-6de5-4a59-abcd-aefa8eab8ea1.tmp
Size 4KB
SHA256 327bfe6f975eba6df578f4e42b7971ff188d74b09042f7be4e7484835b595e62
MD5 89e368f27ee9e9d7d3aac02bc78aa0fe
SHA1 30bdaefd4c4c4fa26740521e13d0c97d186243bc
SHA512 245addef2da19b7d876167dfa288a1ae49fc740e3b4cf94c53d1aaf02c9bbe1f5780e406528d160f6784007df46dec2bcf8accd4edd0593b0fee2f4bafb248e8
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5I8DEDB6vGyvQH4jY/0bblDv4a:qC0xJPz8/CkqDUDzEdfr4jY/0bb1
TLSH
T192A10A31B8695DB794B6D585B2832A03CF64B197E621AFC0B5DD1E1C14FB0F81792A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ddfd35c-72a5-42a1-a4a3-c7700cecab1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9ddfd35c-72a5-42a1-a4a3-c7700cecab1a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cc1a495a-f2ea-4811-865a-30e5cf8e6f26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cc1a495a-f2ea-4811-865a-30e5cf8e6f26.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 cd714242831eeec14b8081db8052bb9ab91fb3973392ebe97001d43df7d2ced0
MD5 b2bcb1a632c86b8e577c583c67411d8d
SHA1 4caaf6a2cadb30036b707990bef23b4b0f75e487
SHA512 f7c0465169c597060c897458ab63f6d67769eede74447c79ea0752b9ff358ad6e051c17cd3d8658f7e7ccc1bbf9ec53b28f73c6847dc19e57b249a8026d4e2ca
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OmHpX6XLqgVum8OrkwkRQ:jeuvBnhJsueMEGvIW1DcP2OO+VumAnRQ
TLSH
T1A2D3984B3A743002EDE58A721CE091BB5E3CB16D4F5595D429B620588EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

5a329a0f-72b4-48b8-9f74-2d1d289eaf52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a329a0f-72b4-48b8-9f74-2d1d289eaf52.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

613659b4-c78e-4e99-be9f-138b7e7a3200.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\613659b4-c78e-4e99-be9f-138b7e7a3200.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 919652eddc0ec0dad543574ddca435767c7e7cdabeae3043dea8ee95625065de
MD5 20c318bfcfef34729cc29e5c4c22cb75
SHA1 430e4171a0708659039692000a36caf1a4c4df48
SHA512 6f5bd92342fdd455c8204befe8b036159d356eb2eb4eed1ca02db5e80bc375b7a7308196415f0f7b26bff8b01b07fafb2390b7155f59daeec36cb97c0615838a
SSDEEP 384:DNrRZyCSDnxTICeMEhIKyll7svbFKfk7:xFZJSDni+yI1l7svbF9
TLSH
T1A544850A7B747001EDE6D9725CB080771E3CB16D8F22E6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb9ec11-4b72-4a8c-a905-3eb663813c4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adb9ec11-4b72-4a8c-a905-3eb663813c4a.tmp
Size 38KB
SHA256 c126a63c548e3e8445ea12233d93cbe9b61809ca5b6ed913e56ff687f71954db
MD5 b93508957e5024eecb18857bc7c575f8
SHA1 b6842ea26ac7fce650b6d4946fef8a38727ac39f
SHA512 ced27c8d06ce7c5376f984a8217b04b2a47722927c791577b11d3b146c164a7b08c813def4a0914631053b281b9a8cd6ff316d13b6a692c9577090497fd451bf
SSDEEP 768:K/UxvxjgC+k3u7VybNbAREztvOeRFZD1fTos7RCh/+Pu:PZj3+k3uxvY1fT/R2Ku
TLSH
T15303BF39F8A86C338CF6E745724AB74BFFF015B385CA199849D96E0E0587B9D1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b96a2529-dc52-4264-a63c-2ae0139d38ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b96a2529-dc52-4264-a63c-2ae0139d38ae.tmp
Size 37KB
SHA256 bba1f264532ede567ef830631f816eed498f43e50f0ab6d839d43aeb3e1d6888
MD5 6ec504a751f3c656d74599d24f48edf8
SHA1 f4e5d10cb680113daf3f95aadc956f07269c0ca9
SHA512 ba31c2b912ba63e4c6e1012aa7d3830186f1bd1712ff6bafa88a19a601e51c849edc7625d67e502bbf97873a4e8c3b13f6f45934e03c063d649f47225215968c
SSDEEP 768:z/UxvxjgC+k3U0QybNbAyOeRFZD1fTos7RzW/+Pu:GZj3+k3U/zY1fT/RCKu
TLSH
T1C503CF3AF8D46D338CF6E244720A764BBFF055B38AC91A9809ED2F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e4efa86-93c5-4aa6-b63a-ae92b28c5fd3.tmp

Path C:\Users\Admin\AppData\Local\Temp\6e4efa86-93c5-4aa6-b63a-ae92b28c5fd3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fcac6f4-a8cd-4183-b1f7-0a85fd020c0d.tmp

Path C:\Users\Admin\AppData\Local\Temp\9fcac6f4-a8cd-4183-b1f7-0a85fd020c0d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jzkojzad.h0e.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jzkojzad.h0e.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aaf6a183-28aa-488e-9f8f-4f77aa146703.tmp

Path C:\Users\Admin\AppData\Local\Temp\aaf6a183-28aa-488e-9f8f-4f77aa146703.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4136_1555329053\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4136_2111226538\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_259812693\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E59848A.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59848A.xml
Size 1KB
SHA256 3df431eb2b654dee6495382e11bbba48e01e3231c5564c71b3c32e66dc748318
MD5 5e2c823127b5802d37651f9c0efa912d
SHA1 5b75a0684ced64fde6eaeca055e9ccc7cf56c5a5
SHA512 af810ce7e4a950e93bfdafd0a425ce70db91cd3dae77ffd4936bac9866fd92fea3906f163c1c4e8d17ad85ec614bc04184f874554fa8859ffab89a29ff51ccf3
TLSH
T1BD31BF57ABFD121AF1F3AB9CEEFA645298B6FC955D20D86D0070050C053293189B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E59866D.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59866D.xml
Size 1KB
SHA256 7797191bed1c486cc3a6bafa8ce4a9d12446a62335093b980a0036a1c7be9c6f
MD5 7e505ad6c255e3fa4c1f0106a17f19dd
SHA1 ccbb4d3cb28b6336521dc2087039fe69c1dd0b80
SHA512 8bb23abd19ad0bc7970a738dec31ed27e2f882e1c78015035ea718ce8533f1ed82c7b95e2c9f416009f3f736e65943fb34809e244b3f2f500d9c4d48c54caf8d
TLSH
T13C31BF57ABFD121AF1F3AB9CAEFA645298B6FC955D20D86D0070050C053293189B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E598998.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E598998.xml
Size 1KB
SHA256 a2a7106716cc8956c1bc39ff20ac95f481f017e1e7ed19f47916948d7384b757
MD5 7a7934c081e0f27ac860df06d451ddc4
SHA1 b9d6ff064d13775f7f30fddffdade6ac5c0ba4bd
SHA512 c750f8cd7e3272bee63aa0d7e40f30a94dcefb683adeb26bc29049cecb605fc36158d1d1fdf73ca714c2cf2f477015cb311058c495a8537c84a39c30b2d7d846
TLSH
T154216B53ABFE221DF1F3AF9CAEB5945299B5FC655D64E42D0070090D0532D328AB1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\loclAp\44e94f3a\Crashpad\settings.dat
Size 40B
SHA256 6cef420af8f650d7904f9676fd3a6f5fd83289b16f0d67497c64f738428eb087
MD5 c2159afc2662cc6415c6f584e16fa1a6
SHA1 635fa041e893aa212310764b536cf883e0eb98f2
SHA512 5c6d3e00607a991a1178d3c05268d8da828619f1029754587fc640a78686cbd7186074ad3b3b95b1f271b444b5ff10c9c7d36a7ace04f3278e1b25cae41e218d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\loclAp\44e94f3a\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\loclAp\44e94f3a\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

11b08a0c-1cda-4f53-b278-42bd4d92bef5.tmp

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\11b08a0c-1cda-4f53-b278-42bd4d92bef5.tmp
Size 3KB
SHA256 6d4f8ff76d1a8e24c8f0048d6b0854cb8f484ac3d21004a47be9c484fe104f58
MD5 8f1c8f5c385e031c3938ff768618d9a8
SHA1 ca5ee1c61922f64991c8a069f18af584f6c14825
SHA512 eea838076327481e7bb6f5b482832589b67b0e52a079a8b33b66f7c90eb15a51bd65c3eb71ad8bb7427a70bfaf5bc3258b032bcc66d7508e92c29dd35b0d79f1
TLSH
T1268196736828FC779FE15A90B48A39138E78E223D755BF8061DD231C05FF69C934A866
MD5 SHA1 SHA512 TLSH

Submit Download

2f699be7-3d14-4e65-b6c8-6eb060fda8bb.tmp

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\2f699be7-3d14-4e65-b6c8-6eb060fda8bb.tmp
Size 4KB
SHA256 99d4677c7b0c699932721d9483b18ea8816818df2491b850bc5cd9eae57fdcc9
MD5 c70b49ef60b4ad4edd12c2cd65fef3bf
SHA1 94efd959da2c2db9ca054f6ab7327f56d481f1ac
SHA512 35b057021a014710675d1034538c0115f37c707908cb9c15ca16f34549518d087ff1b68c3aea6a651d3e257a65abd38c35f105d005ab7e0ba3f66f3b1c4358b0
SSDEEP 96:uqGNkwQsFfZBYHNk1158Frh/cInURoDotovfKDCBKEv5ur90eUcBSDS4SYSuSDSp:VGNsA+HNHooDUwUCGr91i
TLSH
T19DA1B7366434FC6B5EE29A40B4863613AFB4A223E6897F84D1DC1A1C05FF7984346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Crashpad\settings.dat
Size 280B
SHA256 d37dfce910ad0353982e300c2b44e701b5576f6879d0c1e68709a800f05a4b27
MD5 2c18cb482b7b6cf228fc8fa5e8ffcc86
SHA1 0e0f569cdd2852aa3099a6093064fc7bacc19967
SHA512 9bddf7dcc49b245ac0fba698a02ea74753f37207f17e5e20297ef929d164f375a4290e2412752d683890631d693afbdd489be7cc9567024d2e3d21f4777722ef
TLSH
T1F3D0223FBB0888A0C0883A322230E20202C0EE0E30C323FA032C800C38AB880002E3A0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Crashpad\settings.dat
Size 280B
SHA256 f821599b801e400fdffc61a44bfd575b1f90561f5cd588ea4c45ed44071db9d1
MD5 e88975e67275b6cd89934620cf2295b9
SHA1 2c9b2ffbaa8cc977120ddbc2b31b44eec9a457c5
SHA512 c96bb9e44275d761e7e81371c17ecd28ab0193436b73c9521787ae7296f2f222c7198a56369a8ff2755790970def95413bd03ee0bc6a9dd96fb40074b527b350
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\loclAp\d368c527\Local State
Size 1KB
SHA256 6a7b55cade50e6a78a67bb5f53cd1a03d0e727dba54fe0fed81e704db6aecd66
MD5 ada156aa51eb7c1ee9f85335e2af237b
SHA1 7ed0b143ec0330a1a610d0d2f3b02d27926c2acb
SHA512 ca31a1d69d6e5d56cfd8596a14eca84e7a87c949522f6bb7797f7e6fba4cb9fb3e4a934feb3bf1e29e88478bd3ffef01d50632d463a78716c8b65e9c4a56e93c
TLSH
T1A231B574682C3C73EDB18641B14ABB675E74313082513B8851EE052D01FB6CC122DC37
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2160-1313-0x00000000007C0000-0x0000000000AFC000-memory.dmp

Download

memory/2596-1341-0x0000021032200000-0x00000210322B2000-memory.dmp

Download

memory/2732-1322-0x00000000049E0000-0x0000000004A7C000-memory.dmp

Download

memory/2732-1323-0x0000000005290000-0x000000000584A000-memory.dmp

Download

memory/2732-1324-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Download

memory/2732-1321-0x0000000000010000-0x0000000000022000-memory.dmp

Download

memory/2732-1360-0x0000000004CC0000-0x0000000004CCA000-memory.dmp

Download

memory/3676-81-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-108-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-161-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-157-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-153-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-143-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-141-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-444-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-452-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-448-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-455-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-459-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-461-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-460-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-464-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-465-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-494-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-498-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-508-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-129-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-125-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-559-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-562-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-573-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-122-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-583-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-635-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-636-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-632-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-661-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-665-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-664-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-672-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-109-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-113-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-172-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-107-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-97-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-96-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-93-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-77-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-76-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-73-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-74-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-68-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-67-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-66-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-61-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-28-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-27-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-22-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-20-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-21-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-4-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-19-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-18-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-17-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-16-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-15-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-14-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-13-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-12-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-10-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/3676-11-0x0000000148EE0000-0x00000001490E0000-memory.dmp

Download

memory/4540-1307-0x0000000000FB0000-0x0000000000FEC000-memory.dmp

Download

memory/6360-1347-0x000001CE1B720000-0x000001CE1B7D2000-memory.dmp

Download

memory/6456-1331-0x000001F8F6A40000-0x000001F8F6A5E000-memory.dmp

Download

memory/6456-1332-0x000001F8F6A60000-0x000001F8F6B12000-memory.dmp

Download

memory/6456-1333-0x000001F8F6590000-0x000001F8F659A000-memory.dmp

Download

memory/6456-1328-0x000001F8F6520000-0x000001F8F6542000-memory.dmp

Download