badrabbit | hxxp://google[.]com

Resubmissions

08-05-2024 15:30

240508-sxtasabc6y 10

08-05-2024 14:27

240508-rspw5agh4x 10

Analysis

max time kernel
1036s
max time network
1047s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08-05-2024 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

badrabbit discovery persistence ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

Blocklisted process makes network request 3 IoCs

flow	pid	Process
622	4100	rundll32.exe
674	4100	rundll32.exe
732	4100	rundll32.exe

Executes dropped EXE 9 IoCs

pid	Process
2244	ska2pwej.aeh.tmp
72	walliant.exe
4072	43vexu3k.exe
2776	43vexu3k.tmp
1908	7C63.tmp
4752	Walliant.exe
4548	kno1srho.exe
4640	kno1srho.tmp
1048	Walliant.exe

Loads dropped DLL 64 IoCs

pid	Process
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
72	walliant.exe
4100	rundll32.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1784-871-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/1784-872-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/1784-874-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/4084-900-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\walliant.exe"	ska2pwej.aeh.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\Walliant.exe"	Walliant.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
78	camo.githubusercontent.com
84	raw.githubusercontent.com
1	camo.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\7C63.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
196	1784	WerFault.exe	125
1896	4084	WerFault.exe	129

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2688	schtasks.exe
3588	schtasks.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696768468-2170909707-4198977321-1000\{C5537154-67A6-4FF3-8D85-E075C110D0A8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696768468-2170909707-4198977321-1000\{6F6B9248-A57F-4320-B1E3-F696225EE755}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696768468-2170909707-4198977321-1000\{7480C8FC-64E6-47B1-89FB-CCAA17A6B040}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696768468-2170909707-4198977321-1000\{81FAE32A-C452-467C-B168-040664153B3A}	msedge.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	walliant.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Krotten.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Krotten (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Birele.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3208	msedge.exe
3208	msedge.exe
2320	identity_helper.exe
2320	identity_helper.exe
3372	msedge.exe
3372	msedge.exe
2968	msedge.exe
2968	msedge.exe
4104	msedge.exe
4104	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
3220	msedge.exe
3220	msedge.exe
3428	msedge.exe
3428	msedge.exe
2244	ska2pwej.aeh.tmp
2244	ska2pwej.aeh.tmp
1600	msedge.exe
1600	msedge.exe
4696	msedge.exe
4696	msedge.exe
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
1908	7C63.tmp
1908	7C63.tmp
1908	7C63.tmp
1908	7C63.tmp
1908	7C63.tmp
1908	7C63.tmp
1908	7C63.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
2776	43vexu3k.tmp
704	chrome.exe
704	chrome.exe
3724	msedge.exe
3724	msedge.exe
3868	msedge.exe
3868	msedge.exe
2876	chrome.exe
2876	chrome.exe
1584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	72	walliant.exe
Token: SeShutdownPrivilege	4100	rundll32.exe
Token: SeDebugPrivilege	4100	rundll32.exe
Token: SeTcbPrivilege	4100	rundll32.exe
Token: SeDebugPrivilege	1908	7C63.tmp
Token: SeDebugPrivilege	4752	Walliant.exe
Token: SeDebugPrivilege	1048	Walliant.exe
Token: SeDebugPrivilege	1048	Walliant.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	196	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
2244	ska2pwej.aeh.tmp
72	walliant.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
72	walliant.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
4752	Walliant.exe
4752	Walliant.exe
4752	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
72	walliant.exe
72	walliant.exe
4752	Walliant.exe
4752	Walliant.exe
1048	Walliant.exe
1048	Walliant.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 256	3208	msedge.exe	80
PID 3208 wrote to memory of 256	3208	msedge.exe	80
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3980	3208	msedge.exe	81
PID 3208 wrote to memory of 3080	3208	msedge.exe	82
PID 3208 wrote to memory of 3080	3208	msedge.exe	82
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83
PID 3208 wrote to memory of 1460	3208	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b66f3cb8,0x7ff9b66f3cc8,0x7ff9b66f3cd8
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12338815231510719880,2459989170107191029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe"
1⤵
PID:2232
- C:\Users\Admin\AppData\Local\Temp\is-VEPSL.tmp\ska2pwej.aeh.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VEPSL.tmp\ska2pwej.aeh.tmp" /SL5="$702A0,4511977,830464,C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2244
- - C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
    "C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:72
  - - C:\Users\Admin\AppData\Local\Temp\43vexu3k.exe
      "C:\Users\Admin\AppData\Local\Temp\43vexu3k.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
      4⤵
      Executes dropped EXE
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\is-Q2IFL.tmp\43vexu3k.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-Q2IFL.tmp\43vexu3k.tmp" /SL5="$103CA,5010045,830976,C:\Users\Admin\AppData\Local\Temp\43vexu3k.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --noerrdialogs= --enable-features=NetworkService,NetworkServiceInProcess --remote-debugging-port=0 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303 --ignore-certificate-errors-skip-list= --disable-extensions= --window-size=1280,800 --disable-domain-reliability= --no-zygote= --ignore-certificate-errors= --disable-fre= --no-first-run= --no-pings= --disable-setuid-sandbox= --no-sandbox= --disable-background-timer-throttling= --no-default-browser-check= --metrics-recording-only= --disable-sync= --disable-component-update= --temp-profile= --disable-infobars= --remote-debugging-host=127.0.0.1 --disable-hang-monitor= --disable-component-extensions-with-background-pages= --mute-audio= --disable-backgrounding-occluded-windows= --disable-dev-shm-usage= --headless=new --disable-background-networking= --disable-breakpad= --disable-renderer-backgrounding= --no-service-autorun= --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:704
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff9b606ab58,0x7ff9b606ab68,0x7ff9b606ab78
        8⤵
        
        PID:952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1852,i,10864402515760727206,17252879553504828448,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:2
        8⤵
        
        PID:1764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --mute-audio --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303" --mojo-platform-channel-handle=1876 --field-trial-handle=1852,i,10864402515760727206,17252879553504828448,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        8⤵
        
        PID:4084
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --ignore-certificate-errors --mute-audio --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303" --mojo-platform-channel-handle=2136 --field-trial-handle=1852,i,10864402515760727206,17252879553504828448,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        8⤵
        
        PID:3004
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303" --first-renderer-process --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2684 --field-trial-handle=1852,i,10864402515760727206,17252879553504828448,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:1
        8⤵
        
        PID:3856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303" --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2708 --field-trial-handle=1852,i,10864402515760727206,17252879553504828448,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:1
        8⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-backgrounding-occluded-windows= --disable-domain-reliability= --no-first-run= --disable-background-timer-throttling= --no-sandbox= --disable-fre= --disable-component-update= --no-default-browser-check= --mute-audio= --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner962567478 --ignore-certificate-errors= --remote-debugging-port=0 --no-service-autorun= --disable-component-extensions-with-background-pages= --remote-debugging-host=127.0.0.1 --disable-background-networking= --headless=new --disable-setuid-sandbox= --no-pings= --window-size=1280,800 --disable-sync= --disable-hang-monitor= --disable-dev-shm-usage= --temp-profile= --disable-breakpad= --disable-infobars= --enable-features=NetworkService,NetworkServiceInProcess --noerrdialogs= --metrics-recording-only= --disable-renderer-backgrounding= --ignore-certificate-errors-skip-list= --no-zygote= --disable-extensions=
        7⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner962567478 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner962567478\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner962567478 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9b66f3cb8,0x7ff9b66f3cc8,0x7ff9b66f3cd8
        8⤵
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1400,5578601589563893511,16367024021016675520,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,Translate --no-sandbox --disable-breakpad --headless=new --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1456 /prefetch:2
        8⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --allow-pre-commit-input --field-trial-handle=1400,5578601589563893511,16367024021016675520,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,Translate --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=1900 /prefetch:1
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3868
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --metrics-recording-only= --no-service-autorun= --headless=new --disable-renderer-backgrounding= --noerrdialogs= --disable-fre= --disable-infobars= --temp-profile= --no-first-run= --ignore-certificate-errors= --remote-debugging-port=0 --enable-features=NetworkService,NetworkServiceInProcess --disable-breakpad= --no-default-browser-check= --window-size=1280,800 --no-sandbox= --disable-sync= --remote-debugging-host=127.0.0.1 --disable-backgrounding-occluded-windows= --disable-component-extensions-with-background-pages= --disable-setuid-sandbox= --ignore-certificate-errors-skip-list= --no-zygote= --disable-background-timer-throttling= --disable-hang-monitor= --disable-dev-shm-usage= --disable-domain-reliability= --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944 --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --disable-component-update= --disable-background-networking= --no-pings= --mute-audio= --disable-extensions=
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff9b606ab58,0x7ff9b606ab68,0x7ff9b606ab78
        8⤵
        
        PID:4036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1980,i,9605505957887650057,10265086705570762251,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:2
        8⤵
        
        PID:1192
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --mute-audio --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944" --mojo-platform-channel-handle=1780 --field-trial-handle=1980,i,9605505957887650057,10265086705570762251,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        8⤵
        
        PID:4696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --ignore-certificate-errors --mute-audio --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944" --mojo-platform-channel-handle=1892 --field-trial-handle=1980,i,9605505957887650057,10265086705570762251,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        8⤵
        
        PID:2436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944" --first-renderer-process --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2760 --field-trial-handle=1980,i,9605505957887650057,10265086705570762251,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:1
        8⤵
        
        PID:5052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944" --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2784 --field-trial-handle=1980,i,9605505957887650057,10265086705570762251,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:1
        8⤵
        
        PID:400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-sync= --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1698788089 --disable-domain-reliability= --disable-background-networking= --disable-breakpad= --disable-hang-monitor= --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --headless=new --no-sandbox= --disable-renderer-backgrounding= --no-default-browser-check= --metrics-recording-only= --mute-audio= --disable-backgrounding-occluded-windows= --disable-setuid-sandbox= --disable-dev-shm-usage= --disable-fre= --disable-component-update= --disable-extensions= --remote-debugging-port=0 --ignore-certificate-errors-skip-list= --noerrdialogs= --no-pings= --remote-debugging-host=127.0.0.1 --disable-component-extensions-with-background-pages= --ignore-certificate-errors= --no-service-autorun= --temp-profile= --enable-features=NetworkService,NetworkServiceInProcess --no-first-run= --disable-infobars= --window-size=1280,800 --no-zygote= --disable-background-timer-throttling=
        7⤵
        
        PID:864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1698788089 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner1698788089\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner1698788089 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9b66f3cb8,0x7ff9b66f3cc8,0x7ff9b66f3cd8
        8⤵
        
        PID:3504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1368,17086133195111857134,15414918621407748517,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,Translate --no-sandbox --disable-breakpad --headless=new --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1416 /prefetch:2
        8⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --disable-background-timer-throttling --disable-breakpad --no-zygote --remote-debugging-port=0 --allow-pre-commit-input --field-trial-handle=1368,17086133195111857134,15414918621407748517,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,Translate --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=1820 /prefetch:1
        8⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\kno1srho.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kno1srho.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
        7⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\is-S1GAD.tmp\kno1srho.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S1GAD.tmp\kno1srho.tmp" /SL5="$80240,5780393,830976,C:\Users\Admin\AppData\Local\Temp\kno1srho.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
        8⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --ignore-certificate-errors-skip-list --disable-sync --disable-infobars --enable-features=NetworkService,NetworkServiceInProcess --metrics-recording-only --noerrdialogs --disable-background-timer-throttling --disable-dev-shm-usage --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --disable-blink-features=AutomationControlled --disable-component-extensions-with-background-pages --disable-component-update --disable-domain-reliability --disable-renderer-backgrounding --no-pings --no-startup-window --temp-profile --no-default-browser-check --window-size=1280,800 --no-service-autorun --auto-open-devtools-for-tabs --disable-fre --disable-breakpad --headless=new --mute-audio --remote-debugging-host=127.0.0.1 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122 --no-sandbox --disable-hang-monitor --disable-background-networking --remote-debugging-port=0 --homepage=about:blank --no-zygote --disable-backgrounding-occluded-windows --no-first-run
        10⤵
        Enumerates system info in registry
        
        PID:3256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9b606ab58,0x7ff9b606ab68,0x7ff9b606ab78
        11⤵
        
        PID:1304
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1836,i,12086813043419534583,17337933493617689062,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:2
        11⤵
        
        PID:4800
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122" --mojo-platform-channel-handle=1888 --field-trial-handle=1836,i,12086813043419534583,17337933493617689062,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        11⤵
        
        PID:3336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830888588052323017122" --mojo-platform-channel-handle=2024 --field-trial-handle=1836,i,12086813043419534583,17337933493617689062,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        11⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "$id = '1715183088858805';$maxRuntime = 600;$startTime = Get-Date;$emptyCounts = 0;while ($true) {Start-Sleep -Seconds 1;$elapsed = (Get-Date) - $startTime;$processes = @(Get-WmiObject Win32_Process | Where-Object {$_.CommandLine -match $id -and $_.CommandLine -notmatch 'FooBarWillNotMatch';});if ($processes.Count -eq 0) {$emptyCounts++;}else {$emptyCounts = 0;};if ($emptyCounts -gt 3) {break;};if ($elapsed.TotalSeconds -gt $maxRuntime) {foreach ($proc in $processes) {Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue;};break;};}"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-component-extensions-with-background-pages --no-first-run --disable-backgrounding-occluded-windows --disable-component-update --disable-background-timer-throttling --disable-infobars --mute-audio --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --enable-features=NetworkService,NetworkServiceInProcess --temp-profile --disable-dev-shm-usage --window-size=1280,800 --auto-open-devtools-for-tabs --disable-background-networking --no-zygote --disable-fre --ignore-certificate-errors-skip-list --metrics-recording-only --remote-debugging-host=127.0.0.1 --disable-breakpad --headless=new --remote-debugging-port=0 --homepage=about:blank --no-sandbox --disable-renderer-backgrounding --no-service-autorun --no-startup-window --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830894843001082743773 --no-default-browser-check --disable-blink-features=AutomationControlled --disable-sync --disable-domain-reliability --disable-hang-monitor --no-pings --noerrdialogs
        10⤵
        
        PID:1956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830894843001082743773 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830894843001082743773\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner-17151830894843001082743773 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9b66f3cb8,0x7ff9b66f3cc8,0x7ff9b66f3cd8
        11⤵
        
        PID:3016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1624,6254330989848707883,7142678932035416397,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,Translate --no-sandbox --disable-breakpad --headless=new --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1632 /prefetch:2
        11⤵
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "$i='1715183088858805';$ps=@(Get-WmiObject Win32_Process | Where-Object {$_.CommandLine -match $i -and $_.CommandLine -notmatch 'FooBarWillNotMatch'});foreach($p in $ps){Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue;}"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "$id = '1715183089484300';$maxRuntime = 600;$startTime = Get-Date;$emptyCounts = 0;while ($true) {Start-Sleep -Seconds 1;$elapsed = (Get-Date) - $startTime;$processes = @(Get-WmiObject Win32_Process | Where-Object {$_.CommandLine -match $id -and $_.CommandLine -notmatch 'FooBarWillNotMatch';});if ($processes.Count -eq 0) {$emptyCounts++;}else {$emptyCounts = 0;};if ($emptyCounts -gt 3) {break;};if ($elapsed.TotalSeconds -gt $maxRuntime) {foreach ($proc in $processes) {Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue;};break;};}"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "$i='1715183089484300';$ps=@(Get-WmiObject Win32_Process | Where-Object {$_.CommandLine -match $i -and $_.CommandLine -notmatch 'FooBarWillNotMatch'});foreach($p in $ps){Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue;}"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544

C:\Users\Admin\AppData\Local\Temp\Temp1_Birele.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Birele.zip\[email protected]"
1⤵
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 280
  2⤵
  - Program crash
  PID:196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1784 -ip 1784
1⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\Temp1_Birele.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Birele.zip\[email protected]"
1⤵
PID:4084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 248
  2⤵
  - Program crash
  PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4084 -ip 4084
1⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:2996
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2877708161 && exit"
    3⤵
    PID:1724
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2877708161 && exit"
      4⤵
      Creates scheduled task(s)
      PID:3588
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:59:00
    3⤵
    PID:1652
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:59:00
      4⤵
      Creates scheduled task(s)
      PID:2688
- - C:\Windows\7C63.tmp
    "C:\Windows\7C63.tmp" \\.\pipe\{02FBF92B-5452-4542-A313-640B797F0777}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1908

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4044

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2464

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b66f3cb8,0x7ff9b66f3cc8,0x7ff9b66f3cd8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14324801421812206420,3998936804532855517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5756 /prefetch:2
  2⤵
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e4ed4a50489e7fc6c3ce17686a7cd94

SHA1
eac4e98e46efc880605a23a632e68e2c778613e7

SHA256
fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

SHA512
5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dffff4415e0e6d065175d43273b5e4c

SHA1
3406056431b7eeeba36efd50e992d65aaaa4ce62

SHA256
1091af2d3491d72a915ef08cd1eea42ddcdc0e19d3129d1770aceda896bb13a6

SHA512
4ae7494e90ce1bdb62ab40955e8ab8ea5475516e8970c3868a2dc8114f0b36dfa4d0c18c41813951d12e3c8f56c9df47687285b4a01a58a3ed74111215a49d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ff8bdd04a2da5ef5d4b6a687da23156

SHA1
247873c114f3cc780c3adb0f844fc0bb2b440b6d

SHA256
09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

SHA512
5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
27cd4ab4965dcb912f46d6e66ebb0621

SHA1
1f817ec1010dcce1a0c5d9ca7b345393380fea7b

SHA256
9bfa88752e6639ecb25a3824c7cce06cb2f07d05387c58ef4a48047be96bd140

SHA512
0a4fecb9d73d5cc57919b2407e86e1c1aab94f46ca2edd78d578d7144ccb1199923bc1cdca6a32225221cd18c3c4ec261c93370f30edd62fd0e673b1dc680bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7846192c24239da8ef46a95c18f622cd

SHA1
af3eab21bb988b7a5586a84866fecafc0e5fc81e

SHA256
a10e0e45eafb57eff55690fba4d8c8da6e422b27f86e646f65e18054304fd6e1

SHA512
84a7e719d2825ae823a69d2cd7a0dc3d0693de4d732bd67f8fbdafe009b54f840f1ab7c3e31737b0ac961ff399d8b2295a432c7ecac7d6a3e22cf05c6ac03633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
39a6d2b52e5ffa0d8ae651c39b2f0e1b

SHA1
14df200530ae2391f74be9a0d804c2a669390197

SHA256
221f1f3876ff311f84bc14a4866df1e51e34aef394a23e64ecdbb2abe65c494b

SHA512
73774a60f4ad2539f01fa0c5d7c8f6e451da36b5cb78f9b37fcf2a134c720f6918457108df79e06f5b53cbd6db9c7bde1aa5ab4927ace48f6570a9789d289fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1df8f71fe20c38aabb873fc9aa59772e

SHA1
e33aea346d6b2feff599ab53247ee18aa8a46ec6

SHA256
216952517870a11164b5086fd219a1b02fec4cc39ba661372642fbd27a3a0d85

SHA512
4cfcb29cd600aedffc03c48a81b1d737b7a75c1c9cb30a6d3378d27ac7e31044e3f6c11f7094f598d4e66b71578f59d882bdbda35506438d79d80bc967af6645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2c40bbb16d66a1b31a017dd03a19e5a0

SHA1
e7932d48d50e933d9feff6917ec63d9b3bad0ccc

SHA256
d7349334d524db88303ff34cc74c25c71ba88f90333327b1da5c4966d4698045

SHA512
6a332632971ff75e87d3906f618fe385e5c4ab2ec8d4cb7673eeaf5cdfce0fe8844716abe9716ce0569425c900d1be856dcb5147177b8f7903ceaf913d70ad80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2fc0894b6a48675be265951160a2860

SHA1
b4cf0a8b59d5052373d502f3d3e225da5d212490

SHA256
76015754a38ded51e0f0e28360678f5896636e6607ee9ae5301f51651a13f24d

SHA512
d36c0e1a4b0385ed57ba816025647b404c88b93d7755f63c26ed519a2c5df2f3547afa0980241d94ff8853f92d01a174f606a01c767184b15ff84f75014e2d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
54b2dde0b839051586adc8fc9b5e504a

SHA1
633d41f4ea213f15887ba9403691f051dec0701e

SHA256
74997439ca0a5a607c2cb7b8f912226f1168260c04800a4e9caae502895dda15

SHA512
fe313bb3fd6b01a50b7d9c6f4bf66fa41e5dcef7996d4fc3bd592091972f965b72df879e37ac023c9f03988c178a3e781a4adf811536b7c1a3801d4e8e9eb085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8860fa20e1191ba9b6e70ea6e7f40dad

SHA1
fbdb47ee8bc309b554f3f69bd1521db3f7aca630

SHA256
a94f8325fa45e6f12ac9ed1f84dff9d03c54b8d217d58f2b08d19f526b6b2b4a

SHA512
1b6f1a2babddd268b4b2dba05bb83f2c41271d671ba22e702aaa0d86891809130d78eaaf0e9cd4b39d49e4e17be03466201ee297a29b9af4bf96e928a7c14b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
70f6893a11d667e76e3819cb43cf685c

SHA1
5590a6c43e6cb99b071e3484a01402cdd8290433

SHA256
87be5e08129c5de391923d571e5a0377b7011acf06c0de0da3f3515fe410e2ff

SHA512
00ddac8c6404aaa886b72e079fda1d350dc0feb176637dc88186016f3f75f2558ab03b2f4fd384f7af2011932728478b3d124262649a5078c60d0326059406c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
846a160a65080bdfd31d80b9bea73944

SHA1
34f39255db86fa42a986c77b4c8378c1be9c5c29

SHA256
f08f93cb81d922535cd57802d6350c71d3846e997a3f0287714f62ef407d950f

SHA512
a7d40fe35a6b250bec63d9998442e5800a51941d00408fe2d9f2ed428118a16e123a97d0b51ec23f2afa7f9056f07a49fd9b45a39b438481a12f40ce1b8eee35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9a9ec1e4820d0e549327bb924f493b3b

SHA1
2c22b8d221a1d4cf46454a6f9707bc1d4d890f89

SHA256
d97cf1e14c913af5d2cf1bf0e9aec8cf596f37da921fb6a83ca5525a3d0aa4db

SHA512
2b5b6741d6384e7026e99b925592c205ea73522188bd5134822444a5fc45f5158110a803a176215cf45113e4d0c92ec0b98775e8ee2cd0e430ed6cc78f9f6b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
88fb35040672c6a24b3abcac087d3e7f

SHA1
25da75de16d3ac534e0650c2aa0968e0c298e54d

SHA256
72030312878410a0223c001f805175964df5b18f302c34370ecff9b20b14418d

SHA512
3b73555d6445d7e43a437170fce0a99430bdecd107964af187b6a467a2c7162669500230e76c49642295ef56cfcb77df4e6bab9a0f7f5ca1f24fa85bdd9568ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a15b719c51ecb4f975da4fa17ba65df2

SHA1
e5b1f8d9f16066402683682c2e70f5a78c344300

SHA256
a0430c6296e2359e0f78639b6ddd4e25959c4edc49a8047861547060ecd0c7b5

SHA512
d612b3e895813ae0a53e361274318ed2c25863f1bc92a2f50b06aa14987c9b1204c64f4cf0e90228f3dc0b542e3a3fa7158d11a6be4bc148a9f50d6171cb24e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
adbdb575a800443851211e0e3a764027

SHA1
c5743a571a01224bae88bece0b2e9bbf74254c24

SHA256
7377a2752e3756dbbab4e727be6dcb6896f6b4359072616d9ab41cb0dbad638f

SHA512
0f1416ff6cebabb1a1e11ba5a4e079af8a8b3c79a4a87b35734501c43e0fad504a17f5734013ca85f4d65404b9061ca582c1b756848108eec9d68d8bc5f9a78b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ee096835553b0799e0e29ce942a4d87c

SHA1
fa0958f91521c5ddea3b6acfad37072d6c37a667

SHA256
b53f1494b720ab29a45bd689044f2c7d633bf6c4243a84f32191c1274461fa4c

SHA512
5117d6740f412625ae61477f51a473f667648a9e27caf3883edf049f07e72e28c4cfe8f21130eeb255ae13dad1b716cfefdb2cd4fa92c9110facbeae3222affc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d8652f0400fa0d2134a91d29eeacafb5

SHA1
b70103af505e5ffc09c8722d1167104cf4533487

SHA256
e8f1bd3778aa7888589c7a65cfa76d57d1d7d77bacaa7cfbce0655cbf726e75b

SHA512
78b8695cdd9470af6b457c47005d6af54efeadbfd04da3078e22f5f53e006697847258a3199751ccef9888c454093eb4c0fff11a9651e64227ba04c5280f43a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
238114f31e0eb395cce5ee50234fbc2f

SHA1
251e5875ee59184d6cc931e12afc51f9e6cec8c0

SHA256
9a751ec68a3746307aaa0a157e0e44e7e5b729c98601f076fe524166e0050016

SHA512
8102a92dc54aa3bab9089cefbbe701e7e927308ee913915e103ebf8a5046f207172842ea1691f598534e5ec5af7d5826c10ce51f3ed8a8b9ca9bc32193619023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1e019e277083734e6e8023d37a929740

SHA1
b532231f830c3162983e98003dd0ad5f75e3e832

SHA256
9240ac30676694d64b5dd7ab453fe598d1f95a461c71e7d0bc10871513e5b024

SHA512
94ef2e3087c37c6fe0e483573f6947b19a11e2c02f27f6546861f07b946bfd6720e22255afabbdece4874cfd8eaf153bc59c39a6f3c9d6260c246abc86d89ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57afc8.TMP

Filesize
204B

MD5
08b5872853f320c2e089ca6e2f2604e5

SHA1
cfc44bbd1e472c6d1551ae9019ae7887fbc256c1

SHA256
69490dddc13e95c044c09f2ca95f2234a0d8f01011f0c89584bb0d4870dbbbdb

SHA512
abf76ee5c93d1cfd8d60a6cfcd50499b131f363652dfa254e8f3b5afdf66c656241c3c1df732c1ab4f23be7e4669e5acde1c983ea376c0775d29528cf7db9644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e38c66f3-d951-41b0-9c30-521d678dbe9a.tmp

Filesize
2KB

MD5
b2ae97b7ddbdedacf942a707c2f3deda

SHA1
cb44cf00e92f254f596b9366c40fc403b08803dd

SHA256
bdeab8d27d67c1f4458ad561b822d1a3e4daf924d8a645db4c90bf2921241571

SHA512
9760b0602983fddbcbb362c8504dd5bfb65a7c838d3a44af15b89526d6c1dd705f7adad83105ad747fd1af905a5040894363f4c2c9fd722d6af93a54ef5f54e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2d9ca34d9aa992b8c3cd440502f33822

SHA1
381df3cfa101410abf6a75bca3650ecb0dcc10fd

SHA256
5f01c334c797cf0b5458f4a31b652c760c984d1d3dcc21bec81f9756d6ab9b01

SHA512
eb3289ed2ce88269ca94401faf37fe9bbe235fb02808ea94a4964e1c2729e2263fa7fe879229139c91336dae19c797d152e437cd7c5fa1599a9ea328cdf3ef77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da31600de33e48bc8596a990f0130a65

SHA1
2065a605782a2089670126b4557513bf96696521

SHA256
803c1a4ab5f47a0ecc0391f7d9f0e6193294d154dcb067a821b88f71e2eb3086

SHA512
9a1a87967a8bad1b17acf665d4499b00418388637ac4850dd94dd7dd734f4d4e43bc89c739488d39de435bd0755e2ce7b49fd1498ae3ebc6d3823fc0b34230ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9cb588731433845e393eaf6d6ee79afd

SHA1
da6fdfeabd53779efe13d585ec7275802140bca9

SHA256
3d7304dcd24795c5d8099fe25b008230fd473a9f633e896fded654b2ce6dd25b

SHA512
13a6b803108080b9b5892b4b113f1165989ed456f7598a202dbf226f306ef80dec73abf91824fce101d753d4371f7ca435c4e96dd491e6e0fedd6ff9a3eba72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5531820a7b9595834296d78cf8b6064c

SHA1
f8b405e9ed794a666ee86a05128feb1e92d6f124

SHA256
26379c5751244e631013ea4712fb2525555d47b50b9385074e6ac609be6dfff9

SHA512
86e7553886794a1dcbff2539c596e297a0ae3fe43cb8a8451b3ace8066e5fe74b45a21eb35057bc8fc5704b7de3d494b6832807d5df1da7e40143fe3e7e857ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5f9515a62c1b0607b6af2c202fb209a0

SHA1
0d8dcce3518868f41c6bb38134e9669e8991a78a

SHA256
475d4b4bf836309629fdcdccc308d5f891e5503601994986fadb8efe1f3ad256

SHA512
dcf4cbbbd0e49726c13b6da63c08f4124fab770e696d73d8d858c3df76b1f6c8c293a8101f18ea486ac40a2c72cc2638cba291da40a2ed56cfdc139ef03dd49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cdeb0477c1556518f0a22394803c716a

SHA1
3fcdda2c1d1deb5257d9fc86233533b619cff372

SHA256
ddc55100990d11f2ecd98336d8fe509bb55cdc9a984648cbc6dd2ae3bed4fdb7

SHA512
c5ee26b014fca93437248cdb838a60caecc646b8a80df0464883e0bef75ebf53dbf3bacdc23c924042295e1db1a0ead4aa93e3139e47e071e25063abbd66f8b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6559f9460a46bb74c8dbe1812c45922b

SHA1
cabb96dcd06b69b94825b49c443c960802af27c0

SHA256
12e9f58ea42e1d4e3390ca3e24231eaa7c36b51b67599707df6ed64fe7a2d2be

SHA512
c9ea3aa31b2dafb9396473b7f1ecc791113eb1c42d85a72acbce76fda886cc2b37529c7eb976fdfaf0d4a4146757132bf90a039cfbb126c973e2d3247355d21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
31eb91085fd149a20217caa927ebc7a6

SHA1
bfa3d6cd7ae6148d1ae54246104e9fcaac288e12

SHA256
346f89668a1d143856f5bf82352899ac3e7cf540db4a06b182d3c1d2e62c5eaf

SHA512
ee810a23fd882ee912fa828d72e64c4e4a8db9c35a5811aaba19d06e888d2f14816b0ea004bb496ef13972b7c5aa7e69c3cbd34b08d1040c0404396ae5b3d881

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\AsyncBridge.Net35.dll

Filesize
23KB

MD5
35cbdbe6987b9951d3467dda2f318f3c

SHA1
c0c7bc36c2fb710938f7666858324b141bc5ff22

SHA256
e4915f18fd6713ee84f27a06ed1f6f555cdbebe1522792cf4b4961664550cf83

SHA512
e1f456f0b4db885f8475d2837f32f31c09f4b303c118f59be4786cf4303a31a2d3004656a3fcfbbf354326ed404afcb4d60966bca04a5e5de8fb8feaf581bce7

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Countly.dll

Filesize
114KB

MD5
bf6a0f5d2d5f54ceb5b899a2172a335b

SHA1
e8992a9d4aeb39647b262d36c1e28ac14702c83e

SHA256
32ef07a1a2954a40436d625814d0ce0e04f4a45e711beebc7e159d4c1b2556b6

SHA512
49a093345160b645209f4fc806ae67a55ff35e50f54c9fa7ec49d153743e448db9c2fafae61659165d0082fabc473c3e7d47573a481161ddb4c9b5fdd079fc90

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Countly.dll

Filesize
128KB

MD5
304e0f414c764d7a5c2647d721646e13

SHA1
b126d0bc4cd678fe2e2e1acb165d076364807129

SHA256
86cb999ef8b3d20cb81b69ff03580cc6f3d2ca6cc699ab0810fab8cac0e7397e

SHA512
fdb45e066cee6ee5580a1e7fa695804fa0d1959e7c74ad128b60196a137054f3370a5c031cd3fa0f727392e8b71925f739f65978710e0e1e8eb9c2f11782ce9f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Newtonsoft.Json.dll

Filesize
495KB

MD5
283544d7f0173e6b5bfbfbc23d1c2fb0

SHA1
3e33b2ef50dac60b7411a84779d61bdb0ed9d673

SHA256
9165e595b3a0de91ac91a38e742597e12ebb2a5a8fa53058d964a06ceaef7735

SHA512
150b45cd43dc5cf191c85524c15dea09fbb48766ad802851270eaacfd73f3d097fef8dcf0ea042184220e7bc71413677d88a206d8bbe60374986e4789054040b

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Newtonsoft.Json.dll

Filesize
464KB

MD5
83222120c8095b8623fe827fb70faf6b

SHA1
9294136b07c36fab5523ef345fe05f03ea516b15

SHA256
eff79de319ca8941a2e62fb573230d82b79b80958e5a26ab1a4e87193eb13503

SHA512
3077e4ea7ebfd4d25b60b9727fbab183827aad5ba914e8cd3d9557fa3913fd82efe2cd20b1a193d8c7e1b81ee44f04dadfcb8f18507977c78dd5c8b071f8addb

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\SharpRaven.dll

Filesize
72KB

MD5
c1a31ab7394444fd8aa2e8fe3c7c5094

SHA1
649a0915f4e063314e3f04d284fea8656f6eb62b

SHA256
64b7231eda298844697d38dd3539bd97fe995d88ae0c5e0c09d63a908f7336c4

SHA512
3514a69552dd1e1b63a235d7e3a1e982a72a9741ade4a931fc8d8e61f402228ad3243be9321d87fdefdfe137fc357925a931966266ec58c19296adb210be9b0e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\System.Threading.dll

Filesize
378KB

MD5
f5ee17938d7c545bf62ad955803661c7

SHA1
dd0647d250539f1ec580737de102e2515558f422

SHA256
8a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78

SHA512
669a89ad811cda4f3ff4aa318aa03e26e4cb41ea22bc321bad02a671273d867cbd223a64bb30da592a5484a9f1cec77c96f5bf63b1fe586b6d3688b8c9da530c

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe

Filesize
380KB

MD5
cd0784ece74c4789ae1de08cbd8b32ad

SHA1
5b1114e27698cbe2335673624c7eb148db44f237

SHA256
6c5dade1906d32b5ce0cd90a220c87e2b40b3440b7b3f734a68bee264de8d673

SHA512
6f44e8a042ad1d14a3bd3a18873adfbd324f03dec73d023d107617611a5c76c85a2e23969a84cbc7056566e701c8feedb5e6f10475d86a98dd7c56133c8ebdc2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe

Filesize
380KB

MD5
a8bcdafaa225bce2b92fd94d28d9887c

SHA1
964dabdfca259d131a3bd4c53526305eb40ef941

SHA256
860b8b67305fce30e7168bdbf0fd4127c809c716bfc0b28c6c76b3d117c0bbd0

SHA512
47a7b2ad4873b592b49d894ef99bf6170225d4a53c033e9fa90c8b0f9451e11d3330c5462a158d5abbb0c89ac1ab906f4bfcc7558b50b91750797fd8240b05f5

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\sdk.dll

Filesize
11.3MB

MD5
fddc7534f3281feb4419da7404d89b4c

SHA1
19bdefc2c9e0abd03fe5ee4fad9c813a837f844f

SHA256
f13da9813fa11b81ee4180794cbad2b280422716a080bf4c0791996be7f7908e

SHA512
c5428179dc222366234125bd78f63a9350c9329e4d46646bb3361de143974d261bd7a8df6155bc7ef46ad3725302837f4769a26459b8b4b5b5304a810303b1ea

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe

Filesize
257KB

MD5
60d3737a1f84758238483d865a3056dc

SHA1
17b13048c1db4e56120fed53abc4056ecb4c56ed

SHA256
3436c29dec2c7f633f4766acaf334f6c395d70ea6180c0ea7c1610591d5d89b9

SHA512
d34f42b59349f3be1ac39a57207f616a44f56a6c74157be8116fff5df75275928065065a89f10bd79849e58b14d1e5e0ea156be5996ff8ca4f5d854e107c96fe

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe.config

Filesize
1KB

MD5
b492287271363085810ef581a1be0fa3

SHA1
4b27b7d87e2fdbdda530afcda73784877cc1a691

SHA256
a5fcca5b80f200e9a3ff358d9cac56a0ffabb6f26d97da7f850de14f0fb2709e

SHA512
859fa454d8a72771038dc2ff9e7ec3905f83a6a828cc4fc78107b309bdcd45724c749357011af978163f93e7096eb9e9419e3258ea9bd6b652154fe6dd01d036

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ufgheev5.uh0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Default\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Default\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Default\Extension State\LOG.old~RFe61c562.TMP

Filesize
144B

MD5
a4a5eeca56f1e5ad057a774ad6a277f3

SHA1
1a48fa6b84bacfe0e6bcc434f29ff3c9811be17a

SHA256
5d9f3403328669d6d28f9479abc0114de986b41ead314bc243124e2420178728

SHA512
dd056d4397942a3fb61bfd1acef3ea48d762ee26c2c32aa4cdaa17fa9874ba9f1bf5cc2d5e3975f0e653f6903c34c8ad10351f5e45f8024b286ac453b9a63c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner1134556303\ShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944\Default\3c37b740-ff9d-46bf-a465-aa21e38285bb.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner2545508944\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome-runner962567478\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RGR7P.tmp\consent.rtf

Filesize
1KB

MD5
4674c7d5f4e66fcfae14401edf49eb13

SHA1
6f5fb67cce58601d8e035bcaad75c1a32585313a

SHA256
5e97d2c65e343a384413effa92a217efcdfff244875ecb25091d78db2140735b

SHA512
e5a34a217e074c723a08680dc1d584438cc2a96e2b3e879a09265576beff69c7b8cd2fe5c49432da75d27f19c90163802bc20aea7e019e88593008db0d8a83c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VEPSL.tmp\ska2pwej.aeh.tmp

Filesize
2.5MB

MD5
62e5dbc52010c304c82ada0ac564eff9

SHA1
d911cb02fdaf79e7c35b863699d21ee7a0514116

SHA256
bd54ad7a25594dc823572d9b23a3490ff6b8b1742a75e368d110421ab08909b2

SHA512
b5d863ea38816c18f7778ef12ea4168ceb0dae67704c0d1d4a60b0237ca6e758c1dfc5c28d4fc9679b0159de25e56d5dfff8addacd7a9c52572674d90c424946

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\Birele.zip

Filesize
113KB

MD5
6ca327b67f1a2b2a4fbb7f342e15e7bf

SHA1
aab4a7d8199e8416ad8649fede35b846fc96f082

SHA256
460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

SHA512
b7a7574ca52885e531aca71ebe52f7832f8a2436cda047e7686936fe0337eae7c4ebcc57df27c26316871d4167ea4e6794beb933f7c13efb0addac0d400e4d9a

Download Submit
C:\Users\Admin\Downloads\Krotten.zip

Filesize
25KB

MD5
1aea5ad85df3b14e216cc0200c708673

SHA1
e3ee16e93ba7c3d7286dc9ebbaf940f0bcb6cad3

SHA256
8dfa496c93680adc10e77c0946c7927d3e58d79900013c95dfca3411d766bd16

SHA512
06faa190350e4558c6d4f1f201dc0698587495897593aaeac16f3ea3d8c1c7f81d65beea6bc7e730ca1df9bdfdf3cd2bcc84bf50f64787e0b1dbd21492796f36

Download Submit
C:\Users\Admin\Downloads\Krotten.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Walliant.zip

Filesize
4.5MB

MD5
33968a33f7e098d31920c07e56c66de2

SHA1
9c684a0dadae9f940dd40d8d037faa6addf22ddb

SHA256
6364269dbdc73d638756c2078ecb1a39296ddd12b384d05121045f95d357d504

SHA512
76ccf5f90c57915674e02bc9291b1c8956567573100f3633e1e9f1eaa5dbe518d13b29a9f8759440b1132ed897ff5a880bef395281b22aaf56ad9424a0e5e69a

Download Submit
memory/72-1014-0x0000000071220000-0x0000000071D1A000-memory.dmp

Filesize
11.0MB

Download
memory/72-824-0x0000000071220000-0x0000000071D1A000-memory.dmp

Filesize
11.0MB

Download
memory/72-1052-0x0000000071220000-0x0000000071D1A000-memory.dmp

Filesize
11.0MB

Download
memory/72-899-0x0000000071220000-0x0000000071D1A000-memory.dmp

Filesize
11.0MB

Download
memory/72-984-0x0000000071220000-0x0000000071D1A000-memory.dmp

Filesize
11.0MB

Download
memory/196-1714-0x0000000007890000-0x0000000007926000-memory.dmp

Filesize
600KB

Download
memory/196-1715-0x0000000007820000-0x0000000007842000-memory.dmp

Filesize
136KB

Download
memory/196-1716-0x0000000008140000-0x00000000086E6000-memory.dmp

Filesize
5.6MB

Download
memory/1784-871-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1784-872-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1784-874-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2232-815-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2232-773-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2232-734-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2244-774-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/2244-814-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/2776-1016-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2776-1227-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/4072-1015-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4072-987-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4072-1228-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4084-900-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4100-1029-0x0000000002F80000-0x0000000002FE8000-memory.dmp

Filesize
416KB

Download
memory/4100-1018-0x0000000002F80000-0x0000000002FE8000-memory.dmp

Filesize
416KB

Download
memory/4100-1026-0x0000000002F80000-0x0000000002FE8000-memory.dmp

Filesize
416KB

Download
memory/4868-1606-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

Filesize
216KB

Download
memory/4868-1712-0x00000000077B0000-0x0000000007E2A000-memory.dmp

Filesize
6.5MB

Download
memory/4868-1713-0x0000000006460000-0x000000000647A000-memory.dmp

Filesize
104KB

Download
memory/4868-1703-0x00000000064D0000-0x000000000651C000-memory.dmp

Filesize
304KB

Download
memory/4868-1702-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/4868-1679-0x0000000005AE0000-0x0000000005E37000-memory.dmp

Filesize
3.3MB

Download
memory/4868-1670-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/4868-1664-0x0000000005990000-0x00000000059F6000-memory.dmp

Filesize
408KB

Download
memory/4868-1658-0x00000000051C0000-0x00000000051E2000-memory.dmp

Filesize
136KB

Download
memory/4868-1607-0x0000000005260000-0x000000000588A000-memory.dmp

Filesize
6.2MB

Download